Understanding Greed in Social Engineering & Phishing Attacks
Key Takeaways
- Greed-based phishing achieves high click rates: University research, and NINJIO’s own data, shows greed-based attacks are the most effective at manipulating behavior.
- Investment fraud is the costliest cybercrime: The FBI reports investment scams accounted for $6.5 billion in losses in 2024, ranking above BEC and tech support scams.
- Financial promises trigger immediate action: People click on reward-based phishing within minutes because greed bypasses deliberation and critical thinking.
How is Greed Used in Social Engineering?
Bad actors use greed to exploit our desire to acquire wealth . Cybercriminals leverage this emotion through cryptocurrency scams, fake investment platforms, lottery fraud, and business opportunities promising unrealistic returns with minimal effort or risk.
People who fall for greed-based attacks aren’t inherently bad or just after money for money’s sake. They’re looking for the security, freedom, or opportunity that money unlocks. As with all emotional exploitation in social engineering attacks, falling for a greed-based scam isn’t reflective of a person’s moral character, just of their status as a victim of a crime.
Greed-Based Phishing Manipulates You into Taking Immediate Action
According to the FBI’s 2024 Internet Crime Report, investment fraud accounted for $6.5 billion in losses, making it the costliest type of attack and surpassing the second costliest, BEC, by almost $2 billion.
Greed-based social engineering works because it triggers reward-seeking behavior that bypasses rational thinking. When a phishing email notifies the intended victim that there are quick and easy money to be gained, that victim’s thoughts focus more on the potential rewards while minimizing perceived risks. This is why cybercriminals succeed with greed-based social engineering attacks.
The Psychology of Financial Manipulation
Researchers from the Computer Science department at the University of Maryland conducted a study of phishing susceptibility among 1,350 college students through three different scenarios.
One experiment specifically targeted greed by offering a $100 Amazon gift certificate as a supposed prize. What they found was that:
- 93% of students opened the greed-based phishing email
- 83% of those who opened the email clicked the malicious link
- Students often clicked within minutes of receiving the phishing email, demonstrating how quickly greed bypasses rational thought
The study tested three phishing tactics: billing threats (obedience and fear), monetary rewards (greed), and account cancellation warnings (urgency). The greed-based approach achieved the highest click rate in their study, surpassing other tested emotional susceptibilities.
While there’s something to be said about a narrow demographic range in their study, NINJIO’s own data backs up the finding: Greed is the most effective emotional exploit we observe in our platform, with phishing simulations run across age, location, profession, and industry.
What this means for organizations: Even technology-savvy individuals can fall victim to greed-based attacks. People must be trained to easily recognize this kind of emotional manipulation, so they have time to think critically before clicking on that link.
Common Greed-Based Social Engineering Tactics
Some ways that cybercriminals execute greed-based phishing or social engineering attacks include:
- Fake crypto investment sites promise hands-free income through complicated investment methods, using insider-sounding language to seem trustworthy.
- Get-rich-quick schemes offer unrealistic returns from fake investment opportunities that promise wealth in little time with no risk.
- Romance scams transitioning to investment fraud, where attackers build trust over weeks before introducing “investment opportunities.”
- Lottery or prize scams that require upfront “processing fees” or “taxes” to claim fictitious winnings.
According to NINJIO’s Unhackable Workforce Report, greed frequently combines with other emotional susceptibilities—particularly opportunity, curiosity, and obedience.
Greed vs. Opportunity: What’s the Difference Between These Emotional Susceptibilities?
While both greed and opportunity involve potential gains, cybercriminals exploit these emotional vulnerabilities with different tactics.:
- Greed exploits our desire to get rich quick. This includes the allure of monetary gain, eliminating debt, or securing financial freedom through exceptional returns with minimal effort. Example: A message promising “guaranteed 40% annual returns on cryptocurrency investments” exploits greed, an individual’s active pursuit of wealth.
- Opportunity exploits the concept of scarcity and exclusivity, targeting our need to prevent perceived loss. Opportunity-based phishing may also invoke the fear of losing out on something that might disappear through fabricated time limits. Example: A message warning “only 3 spots left in this level exclusive investment program,” makes you act fast to gain what appears to be an exclusive spot.
Why it matters: Employees vulnerable to greed need personalized security coaching on spotting unrealistic return offers, while those susceptible to opportunity-based phishing need training on recognizing artificial exclusivity or limitations. This form of training addresses each individual’s unique vulnerabilities.
Download The Unhackable Workforce report for comprehensive guidance on identifying and addressing emotional susceptibilities across your organization.
How to Defend Against Greed-Based Social Engineering
The problem with greed-based social engineering is that it exploits an individual’s wishful thinking. When someone wants something to be true, they’re more likely to ignore the warning signs.
Red Flags for Greed-based Phishing
- Unrealistic returns: Guaranteed returns well above market rates
- Unusual payment methods: Cryptocurrency, wire transfers, or gift cards for investments
- Unsolicited opportunities: Unexpected investment offers via email, social media, or phone
Organizational Defense Protocols
- Multi-person approval: Require two people to authorize significant financial transfers
- Out-of-band verification: Confirm requests through separate communication channels
- Official channels only: Make investment decisions through verified, official forums and procedures
Learn more about building individual defenses for your organization in The CISO’s Guide to Social Engineering Susceptibilities.
Get Cybersecurity Awareness Training That Works
Generic cybersecurity awareness training fails because it doesn’t account for individual vulnerabilities, keep people engaged, or get updated with new attack vectors.
An effective cybersecurity awareness training session should be short, engaging, and relevant to help employees learn about real cyberattacks and how victims are manipulated. The training program can also include:
- Simulated phishing exercises that test responses to different emotional susceptibilities in safe environments.
- An emotional susceptibility profile that gives an organization visibility into how employees respond to potential threats in their work environments.
- Personalized security coaching that educates employees on how it “feels like” when cybercriminals manipulate them against attacks specific to their vulnerabilities and thus defend against them.
Ready to build emotional defenses against social engineering across your organization? Schedule a demo to see how NINJIO’s human risk management platform identifies individual vulnerabilities and delivers personalized security coaching that changes behavior.
Frequently Asked Questions
A: Intelligence, even in a cybersecurity context, doesn’t protect someone against emotional manipulation. We all have impulses. Greed triggers reward centers that make risk feel abstract while potential gains feel immediate and real.
A: Legitimate opportunities never pressure you for immediate action, rarely contact you unsolicited, and always provide verifiable credentials. Verify independently before committing.
A: Cryptocurrency’s complexity, legitimate success stories, recovery difficulty, and the perception that early adoption leads to wealth create perfect conditions for greed exploitation.
A: Implement multi-person approval for transfers, require out-of-band verification for unusual requests, and train employees to recognize emotional manipulation tactics.
A: Emotional susceptibilities vary significantly between individuals. Personalized security coaching targets an individual’s specific vulnerabilities and adapts to user behavior over time.
About NINJIO
NINJIO’s human risk management platform reduces cybersecurity risk through personalized security coaching, engaging awareness training, and adaptive testing. Our multi-pronged approach to risk mitigation focuses on the latest attack vectors to build employee knowledge and the behavioral science behind social engineering to sharpen users’ intuition. Our simulated phishing and coaching tools build a proprietary Emotional Susceptibility Profile for each user to identify their specific social engineering vulnerabilities and change behavior.
