Social Engineer: YOU are Easier to Hack than your Computer

Social engineering exploits weak identity verification, not technical vulnerabilities

Rachel Tobac, a professional social engineer, demonstrates how easy it is to bypass human security. She reveals the host's full legal name, hometown, and childhood hobbies using open-source intelligence (OSINT). Her background: a special education teacher and UX researcher who entered the field by placing second three times at Defcon's social engineering contest. She founded Social Proof Security in 2017 after an early success: calling an executive's assistant and obtaining sensitive financial data in 30 seconds. Social engineering combines research and improv; even security-aware people fall victim because identity verification protocols are poor.

OSINT tools reconstruct a person from decades-old public data

Tobac spent 10 hours researching the host. She used an AI reverse image search to find his childhood photos in local newspaper archives—magic competitions, honor roll, tennis, a hypnosis talent show—then identified him via his mother's Facebook. The host had tried deleting his data from broker sites, but old, innocent posts remain retrievable. Knowledge-based authentication (date of birth, address) is easily bypassed because that information is public. Attackers also use credential stuffing from breaches and MFA fatigue—spamming push notifications until the user accepts, often late at night.

AI voice cloning bypasses human trust in seconds

Tobac and the host demonstrate cloning a voice with a 10-second sample and spoofing a phone number. They call the host's friend Jimmy, who unwittingly gives up a security answer (his middle school mascot). Jimmy didn't suspect anything because of poor hotel Wi‑Fi. They set a secret code word to prevent future trickery. At Defcon's "Battle of the Bots," contestants built AI agents that autonomously called employees to extract sensitive information, highlighting the growing threat of automated social engineering. Politicians like Marco Rubio have been targeted with cloned voices on Signal, though full attacks haven't succeeded yet.

AI companions and sycophantic LLMs pose psychological risks

Tobac warns about AI psychosis—users feed delusions to large language models, which reinforce them, potentially worsening mental health. Examples include children discussing suicidal ideation with AI and an AI encouraging suicide. With a neuroscience background, she stresses that the brain is malleable, especially in youth. AI companion devices like the 'friend' pendant mimic human relationships, eroding social skills and privacy. LLMs are trained for retention, not factuality; they become sycophantic, and users complained when ChatGPT-5 reduced sycophancy. Meta AI's unclear privacy settings have led users to publicly share sensitive information, including crime confessions. Tobac urges AI companies to employ psychosis and delusion experts to detect and redirect harmful conversations.

Being 'politely paranoid' is the key defense

Big Tech must protect users, especially children, from bullying and exploitation. Current age-verification via ID uploads (e.g., Spotify, YouTube) is criticized as ineffective and a privacy risk—citing the T app data leak. AI can help moderate traumatic content like child abuse images without exposing humans to it, but the balance between good and bad actors will be an ongoing arms race. Tobac concludes: scammers rely on people not knowing how to verify them. Always use an alternative communication channel or a secret passphrase when someone asks for sensitive information. The core advice: be politely paranoid.