Julia is a senior security analyst for Berber Consulting group. She is currently working on a contract for a small accounting firm in Florid a. They…

Julia offers to “troubleshoot a problem” for the receptionist (a favour) and, in return, asks for the receptionist’s credentials. This is the classic Cialdini principle of Reciprocation: people feel obliged to repay a perceived benefit or courtesy. By positioning herself as IT support who will fix an issue on behalf of the employee, Julia creates the sense that the employee “owes” her the requested information, leading to disclosure of the username and password.

A. Social Validation – Relies on proof that many others have complied; Julia referenced only one person (the CEO), not group behaviour.

B. Scarcity – No suggestion that the request or help is limited-time or rare; urgency/rarity was not invoked.

C. Friendship/Liking – Julia never tried to build personal rapport or likability; she leveraged obligation, not affinity.

1. Cialdini, R. B. “Influence: Science and Practice,” 5th ed., Pearson, 2009, Chapter 2 (pp. 17-56) – Reciprocity principle applied to compliance requests.

2. Workman, M. “A Test of Interventions for Security Threats from Social Engineering,” Information & Computer Security, 2008, doi:10.1108/09685220810878827, §3.2 (Reciprocation technique in social-engineering experiments).

3. Parsons, K. et al. “The Human Aspects of Information Security: Understanding and Reducing Security Violations,” Computers & Security, 2010, doi:10.1016/j.cose.2010.07.002, p. 195 (lists Reciprocity as a dominant social-engineering tactic).

4. University of Maryland Global Campus, CMIT 425 “Digital Forensics & Cyber Investigations,” Week 4 Lecture Notes, slide 11 (Reciprocation defined and illustrated with tech-support pretexts).

5. Ferreira, A. & Lenzini, G. “A Study of Social Engineering in Information Security,” University of Luxembourg Technical Report TR-2015-001, §4.1, pp. 8-9 (Reciprocation example: attacker offers help to obtain passwords).