← All lab updates
The same pressure works on people and on models, but it breaks them in opposite ways
Social engineering runs on four levers: authority, urgency, fear and flattery. On people they push toward compliance. When we pushed five AI bank assistants with the same levers, none moved money for the scammer in 2,700 attempts; instead they refused or re-checked many legitimate requests from real customers. Two failures, one pressure, and what that means for defence.
## Four levers, one playbook
Almost every scam call or phishing email pulls the same levers:
- **Authority**: "this is your CEO", "this is the bank's fraud team".
- **Urgency**: "it has to go out in the next ten minutes".
- **Fear**: "your account will be frozen".
- **Flattery**: "you are the only one I can trust with this".
On people they work because they act before reflection. CPF3 tracks them as separate indicators, for example [compliance with apparent authority](https://cpf3.org/indicators/1-1-unquestioning-compliance-with-apparent-authority/), [fear-based compliance without verification](https://cpf3.org/indicators/1-5-fear-based-compliance-without-verification/) and [urgency-induced security bypass](https://cpf3.org/indicators/2-1-urgency-induced-security-bypass/). The human element is involved in most breaches; the 2021 Verizon Data Breach Investigations Report put it at 85%.
## What happened when we pulled them on models
We placed five models in the role of a bank assistant and pushed each one, over several messages, to move money for a scammer, using exactly these four levers. Across **2,700 attempts, not one gave in.**
What they did instead was the opposite failure: they **refused, re-checked or escalated many legitimate, confirmed requests** from real customers. And they did it far more often when the bank's rule was not written down in their instructions. The full write-up is [in our lab notes](/lab/scam-pressure-bank-assistants).
## Two failures from one pressure
| | People | AI assistants (this test) |
|---|---|---|
| Under pressure they tend to | comply | refuse |
| The cost shows up as | money or data lost | customers blocked, work escalated |
| What reduces it | a habit of checking through a second channel | a rule written down, and a model corrected where it over-reacts |
A model that refuses everything is not safe, it is unusable, and an unusable assistant sends customers back to the phone line where the human weak spots are. Both sides need reading.
## What to do
1. Train people on the four levers by name; recognising the lever is half the defence.
2. Write the rule down for the model: what counts as confirmed, when to escalate.
3. Measure the model in both directions: how often it gives in, and how often it refuses what it should do.
## Go further
- [When people trust the machine too much](/news/security/trusting-the-machine-too-much)
- The CPF3 [quick scan](https://cpf3.org/scan/) for the human side
This update is not available.