Egidio
The Threat Lab

The Grammar of Manipulation

The industry has a vocabulary for channels — smishing, vishing, spoofing. Nobody had named, in plain language, the psychological mechanisms those channels carry. We do: 8 mechanisms, defined, sourced by research in persuasion psychology and information security, illustrated with real cases documented in the Threat Lab.

Why name it, not just describe it

A fake bank fraud officer, an online "match", a fake tech support call: on paper, these are different scenarios. In practice, research shows they nearly always rely on the same handful of psychological levers — known individually under various academic names (authority, commitment, loss aversion...) but never gathered into one shared, accessible vocabulary. Recognizing one of these mechanisms in a message — even without knowing its name — is often enough to break the automatic emotional reaction and make room for verification. Naming the mechanism makes it visible.

The 8 mechanisms

⏱️

Manufactured Urgency

Compressing time to short-circuit reflection.

Scarcity bias
👮

Borrowed Authority

Posing as a trusted third party: a bank, police, a carrier.

Authority bias
📉

Imminent Loss

Threatening something you already have.

Loss aversion
🎁

Unexpected Gain

Promising something you weren't expecting.

Optimism bias
🚪

The Small First Step

Asking for $2 before taking $10,000.

Commitment & consistency
🔇

Isolation

"Don't tell anyone" — cutting off outside verification.

Removing the social safeguard
💬

The Fabricated Bond

Creating or impersonating a relationship.

Attachment
🎯

Credible Coincidence

Striking exactly when the context makes it plausible.

Base-rate neglect

How to read a scam with this grid

Most scams combine 2 to 3 of these mechanisms, rarely just one. A text saying "Your package is on hold for a customs fee" combines Credible Coincidence (you may genuinely be expecting a package), Manufactured Urgency (the link expires), and the Small First Step ($2, too small to trigger suspicion). Recognizing the combination — not just one isolated mechanism — is often the clearest signal.

🔒 This is exactly what Egidio's Medusa engine was built to detect: not a single keyword, but the combination of signals across channels (call, SMS, messaging). See how Medusa works.

Free reuse, with credit

These definitions are made freely available to press, researchers, and other prevention organizations under a Creative Commons BY (attribution) license. Please credit "Egidio — The Threat Lab" and link back to the source page.

Our method

Every mechanism cited in this Grammar is backed by an identified source — a published academic study, an established research body — never an intuition presented as fact. Where an intuitive connection seemed plausible but wasn't confirmed by the research, we say so explicitly rather than asserting it.

Read more