Authority

Authority works because compliance with legitimate institutions is normal, correct and mostly automatic. Most people have never had cause to doubt a call from a tax authority, a police force or their own bank, because most people have never received one.

Cialdini identified authority as one of the core principles of influence, and fraud uses it in its plainest form: adopt the identity of a body whose instructions you would not normally question, then issue an instruction.

Two things make it cheap to run. Caller ID is trivially spoofed, so the display showing a real agency number proves nothing. And breach data supplies enough true detail, part of a Social Security number, an old address, a recent transaction, that the first thirty seconds of the call verify themselves.

The tell is never the identity. It is the instruction. Real institutions do not specify that you must pay by gift card, do not require you to move money to a different account, and are not damaged by you hanging up and calling back on a number you found yourself.