The bias exploited
Base-rate neglect describes our difficulty in correctly weighing the baseline probability of an event when a specific, striking piece of information is presented — here, the fact that the message lands "at just the right time" masks the far higher probability that this timing comes from targeting based on data the scammer already has, rather than mere coincidence.
Source: Tversky, A. & Kahneman, D. (1974), "Judgment under Uncertainty: Heuristics and Biases," Science, 185(4157). Accessed 07/17/2026.Three real cases
🗂️From leak to scam
A data breach (name, address, purchase history) lets a scammer build a message that seems to "guess" your situation — when it's actually data the scammer already has, not a coincidence.
See From Leak to Scam🇺🇸A record year for data breaches
The volume of personal data in circulation from large-scale breaches keeps growing year over year — fuel that directly feeds the precision of this kind of targeting.
See US Data Breaches📦The package text that lands on the right day
A generic smishing blast sent to thousands happens to reach some recipients who are genuinely expecting a package that day — a simple statistical volume effect, but perceived individually as an unsettling coincidence that reinforces trust.
See The Evolution of SmishingHow to recognize it
A message that arrives at a suspiciously convenient moment — always ask yourself: have I shared this information (an order, a form, a social post) somewhere recently? An apparent coincidence is more often a piece of data the sender already had.
Definition freely reusable with credit ("Egidio — The Threat Lab") and a link to this page. See the full Grammar of Manipulation.