Social Engineering & FraudMANIPULATIVE

Elicitation

What it is

Steering an ordinary-seeming conversation so that a target reveals sensitive information without ever being directly asked for it, and usually without realizing anything was extracted.

How it works

Elicitation exploits the reciprocity of self-disclosure and the human urge to correct, complete, or appear knowledgeable. Rather than asking a question that would trigger suspicion, the operator makes a statement the target will want to amend ("I heard your team is still on the old system"), offers a small confidence to invite one in return, or feigns ignorance so the target helpfully explains. Deliberate flattery ("you clearly know this area better than anyone") lowers guard, and a false or exaggerated claim provokes a knowledgeable listener to set the record straight with real details. Because each individual disclosure feels harmless and voluntary, the target never experiences a moment of decision; the sensitive picture is assembled across a friendly chat or several. The FBI's counterintelligence materials and Hadnagy's work catalog these conversational moves precisely so that people can recognize when a pleasant exchange is quietly harvesting them. The tells are consistent: disproportionate interest, flattery that arrives with questions, and a conversation that keeps returning to one topic.

Real-world examples

  • •At a conference bar, a friendly stranger complains that "nobody really uses multi-factor anyway," prompting an engineer to proudly explain exactly which systems his company protects and how.
  • •A caller feigns confusion about a company's org chart, and a helpful employee corrects the "mistakes," confirming names, roles, and reporting lines useful for a later impersonation.
  • •Intelligence tradecraft has long used the deliberate wrong statement, because a specialist will often reveal classified nuance simply to correct an error.
  • •A recruiter-style chat that praises a candidate's current project draws out architecture and security details the candidate would never have volunteered to a stranger who asked directly.

Ethical guidelines

  • ●Extracting information a person would withhold if they understood the purpose is deceptive, even when no question is ever asked outright.
  • ●Journalists, researchers, and investigators should disclose their role when soliciting information that a source would guard if they knew who was listening.
  • ●Authorized elicitation in security assessments must stay within a signed scope and must not target individuals' private lives to build leverage.

How to defend against it

  • ►Notice interest that is out of proportion to the relationship: a new acquaintance steering repeatedly toward your work internals is a tell, not a compliment.
  • ►Decide in advance what you will not discuss with people outside a need-to-know, so the choice is made before flattery or rapport can move it.
  • ►When a statement invites you to correct it with sensitive detail, you can simply not take the bait: "I couldn't say" is a complete answer.
  • ►Be wary when praise arrives bundled with questions; the ego lift is doing the work of the interrogation.
  • ►For organizations, teach staff the common conversational moves by name, since recognizing the pattern (Persuasion Knowledge) is what breaks its power.

From the Defense Playbook

"Why Do You Ask?"seconds

Answer an intrusive, oddly specific, or out-of-place question with a friendly question of your own about its purpose, which buys time, reveals intent, and breaks the reflex to answer simply because you were asked.

Every playbook entry states how strong its evidence is and when not to use it. Browse the full playbook.

References

  1. Hadnagy, C. (2018). Social Engineering: The Science of Human Hacking (2nd ed.). Wiley
    Catalog of conversational elicitation moves (deliberate false statement, feigned ignorance, flattery) and their recognition signals.
  2. Mitnick, K. D., & Simon, W. L. (2002). The Art of Deception: Controlling the Human Element of Security. Wiley
    Case studies of piecing together sensitive information from individually harmless disclosures across friendly conversations.
  3. Stajano, F., & Wilson, P. (2011). Understanding scam victims: seven principles for systems security. Communications of the ACM, 54(3), 70-75 · link
    General principles (herd, kindness, need-and-greed) that explain why targets volunteer information to a plausible stranger.
Last reviewed
Suggest a correction

Detect Elicitation in any text

Paste any message, email, or article into our free Manipulation Detector to see if Elicitation or other techniques are being used on you.

Try the Detector FreeCreate Free Account

Related Articles

Social Engineering: Why Smart People Fall for It

Social engineering does not target stupidity. It targets helpfulness, deference, and time pressure, which are the same habits that make people good at their jobs. Here is how the attacks are built and which procedures actually stop them.

7 min read

The Disinformation Playbook: How Campaigns Are Built and Where They Break

Disinformation campaigns follow a recognizable sequence: seed, launder, amplify, and let real people carry it the rest of the way. A field guide to the stages, drawn from the research, with the defences that work at each one.

8 min read