Books on deception and social engineering: what investigators read

Deception and social engineering are usually shelved apart, although they describe the same exchange from opposite ends. Someone seeking access they are not entitled to has to steer the other person's attention and offer a plausible reason for an unusual request. They often need to draw out information as well, without appearing to ask for it. Whoever is on the receiving end, or reconstructs the exchange afterward, has to notice where the account stopped fitting the facts.

This reading list draws on the Falcone International Book of the Month series, grouped by the part of the subject each book explains best. Each entry sets out what the book teaches, who in an organization would gain most from it and one idea worth carrying into practice. A final section defines pretexting, tailgating and elicitation and the controls that address each of them.

How attention is managed

The Official CIA Manual of Trickery and Deception (Melton and Wallace)

In the 1950s the CIA commissioned the stage magician John Mulholland to write manuals on operational deception. H. Keith Melton, an intelligence historian, and Robert Wallace, a former head of the Agency's Office of Technical Service, reproduce them with historical framing. Mulholland's central point is that a deceiver succeeds by controlling where an observer looks, leaving the observer to fill the gaps from expectation. The manuals apply that idea to carrying out an action in full view and to behaving so unremarkably that nobody looks twice.

Physical security managers and facilities teams should read it for the material on inconspicuousness, which Falcone's review of the CIA manual connects directly to physical access. A person who looks as though they belong in a building is rarely asked why they are there, and tailgating depends on exactly that. Investigators will find a quieter lesson about how little witnesses notice and retain, which argues for testing recollections against logs and documents in a corporate investigation. The idea to carry away is that attention is the medium deception works in, which makes a pretext easier to spot while it is still under way.

A person who looks as though they belong in a building is rarely asked why they are there, and tailgating depends on exactly that.

How a pretext gets someone inside

People Hacker (Jenny Radcliffe)

Jenny Radcliffe is a social engineer whom organizations hire to get into their own premises. Her book covers thirty years of that work, nearly all of it done by persuading someone to let her in rather than by defeating a lock. Reconnaissance comes first, using what the target has published about itself. She then adopts a role plausible enough that questioning it would feel impolite. From there she relies on two dependable habits, the reluctance to challenge someone who seems senior and the impulse to help someone who seems to be struggling.

Reception managers and whoever owns security awareness training should read it. Her most useful argument concerns training, since warning staff to be suspicious conflicts with a customer-facing role and tends to be quietly ignored. What people will actually use is a specific and courteous way of confirming who a visitor is. The review of People Hacker describes how an assessment can start where her own preparation does, with staff directories and event photographs.

The Irregulars (Jennet Conant)

Conant's history follows Roald Dahl, who joined the British Embassy in Washington in 1942 with the title of assistant air attaché. His real task was to dine in the homes of senators, newspaper proprietors and the Vice President, and to report what he heard to British Security Coordination in Rockefeller Center. Through the Texas newspaper owner Charles Marsh, Dahl came to know Vice President Henry Wallace, whose candid remarks on post-war policy eventually reached Churchill. Wallace was never recruited or tricked, and he simply spoke freely among people he took to be friends.

Board members and senior executives who attend conferences and private dinners should read it. The routes it describes are introductions, standing invitations and the pleasure some people take in being consulted, and none of them would trouble a security team. The idea to keep is that the most productive sources often have no idea they are acting as sources. The review of The Irregulars suggests listing the access routes Dahl used and checking which are open around an organization's own principals.

How trust is manufactured

The Gift of Fear (Gavin de Becker)

Gavin de Becker has spent his career assessing threats to public figures. His book argues that violence is usually preceded by observable warning signs that people register and then talk themselves out of acting on. Several of the behaviors he catalogs apply directly to business dealings. In his account, an unsolicited promise suggests the speaker has sensed doubt and wants to override it. Forced teaming invents a shared predicament to hurry a relationship along, while a small favor nobody asked for leaves the recipient feeling indebted.

Hiring panels and deal teams should read it, along with anyone who handles requests from strangers. Its most practical idea is the distinction between fear, which responds to a present signal and calls for action, and worry, which is a story about the future. In an appointment, that distinction supports treating a panel's unease about a candidate with flawless references as a reason to look further. The review of The Gift of Fear explains how an executive background investigation can test that unease against people the candidate did not nominate.

Never Split the Difference (Chris Voss with Tahl Raz)

Chris Voss was the FBI's lead negotiator in international kidnappings, and the book, written with Tahl Raz, sets out the techniques he relied on. They include repeating a counterpart's last few words, naming the emotion you believe you are hearing and asking open questions that begin with "how" or "what". As the review of Never Split the Difference notes, every technique is presented from the side of the person applying it. There is little on recognizing the same moves when a counterpart uses them on you.

Commercial negotiators and executives involved in transactions should read it with that defensive use in mind. Its most transferable lesson concerns time, because Voss shows how artificial urgency degrades judgment and how often a supposedly shared deadline belongs to one side. A caller who tells a service desk they are locked out and need access before a deadline is relying on the same effect. Asking whose deadline is running is as useful on a support call as it is across a negotiating table.

How deception is detected

Spy the Lie (Houston, Floyd and Carnicero)

All three authors are former CIA officers, writing with Don Tennant, and their method is deliberately narrow. The interviewer asks a short, clear question and attends only to what happens in the following five seconds. What appears is compared with a fixed list of indicators, such as failing to answer or attacking the questioner. A lone indicator carries no weight, and only a cluster of at least two, prompted by the same question, is treated as worth acting on.

Anyone who interviews people in an internal investigation or a misconduct inquiry should read it, starting with the chapters on building a question. A vague question produces an answer that no amount of careful watching can rescue. The review of Spy the Lie is equally clear about the method's limits, chiefly that the book says little about the honest interviewee who is simply frightened. The idea to carry away is that a cluster of indicators should shape the next question or document request, and should never be recorded as a finding about the person. That is also how we treat signs of deception in an executive background investigation, where they prompt verification of something specific.

A cluster of indicators should shape the next question or document request, and should never be recorded as a finding about the person.

How Spies Think (David Omand)

Sir David Omand, a former Director of GCHQ, argues that the methods intelligence analysts use under uncertainty can be learned by anyone who decides with incomplete information. His model separates four questions, which are what is happening, why, what is likely to follow and what might happen that nothing yet indicates. He adds the Bayesian habit of stating a prior view and adjusting it in proportion to each new piece of evidence.

Due diligence teams, fraud investigators and analysts who assess counterparties should read it, and the review of How Spies Think singles out the chapters on how deliberate deception is built around a target's expectations. The idea worth keeping is to assume that a hostile subject has a fair idea of what you will look for. On that assumption, the picture you find may have been arranged for you to find it.

Pretexting, tailgating and elicitation, defined

Each of these terms names a weakness that can be tested and a set of controls that can be strengthened.

Pretexting is the use of an invented but believable reason to obtain something the requester would not otherwise be given. A familiar example is a caller who claims to be a locked-out employee and asks for a password reset. Between April and May 2025 the same attackers disrupted three UK retailers. At Marks & Spencer, the attackers got in through a call of that kind to a service desk run by a third-party provider. The main defense is an identity check that a busy agent cannot waive under pressure, rehearsed in workshops and training built around the approaches staff are likely to meet. Multi-factor authentication and access limited by job role, discussed in the article on employee training and technical controls, narrow what an attacker can reach once a pretext has worked.

Tailgating is following an authorized person through a controlled door or barrier without presenting a credential. It usually succeeds because the intruder appears to belong or the person ahead holds the door out of courtesy. Card readers and turnstiles therefore do little against it on their own. In a security and safety assessment we test, where that has been agreed, whether access control can be walked past in practice. The assessment also examines whether staff recognize an approach and know the route for reporting it.

Elicitation is drawing out information through conversation that seems casual, so that the person speaking does not realize they are being questioned. It relies on flattery, shared interests and settings that feel off the record, such as conference dinners and informal meetings. Technical controls offer little protection against it, so the defense lies mainly in preparing the people most likely to be approached. Our workshops cover counter-intelligence, including the methods adversaries use to reach an organization's sensitive information.

Where the reading leads

Each of these books describes a weakness that is hard to see from inside an organization, because the people being exploited are behaving reasonably and usually helpfully. Reading about the techniques helps people recognize them, although it cannot show whether a particular site or service desk would hold up against someone practiced at them.

A security and safety assessment answers that question for physical access, and workshops and training give staff a rehearsed response to the approaches they are most likely to meet. An executive background investigation tests whether a candidate is who they present themselves to be. Where a deception has already succeeded, a corporate investigation establishes what happened, securing evidence before anyone is interviewed.