Curiosity based scams often start with something as small as a USB drive sitting in a car park, left there like someone dropped it by accident. There is no label. Nobody is around to ask.
Something in you wants to plug it in, just to see what is on it. That pull is not carelessness.
It is the same pull that makes you open a message that says “you won’t believe what someone said about you.”
Wanting to close a gap in what you know is one of the most human responses there is. Scammers have simply learned to build gaps on purpose.
In November 2025, Google filed a lawsuit alleging that a China-based operation had built nearly 200,000 fraudulent websites in just twenty days. Many used curiosity-triggering subject lines and fake QR codes to route victims toward lookalike Google, USPS and toll-payment pages, harvesting card details and login credentials from anyone who clicked.
This post explains why the information gap pulls at you so strongly. It also shows how clickbait and forbidden-knowledge messages are engineered to exploit it. From there, it covers how that same pull moves offline through USB drives and QR codes, and the one habit that interrupts curiosity based scams before they cost you anything. It builds on the wider pattern in our guide to how scammers manipulate people.
Why Do We Feel Compelled to Close the Information Gap?
Psychologists call it the information gap. The moment you notice there is something you do not know, a small, real discomfort sets in.
Closing that gap feels like relief. It is the same itch that makes you check a notification the second it arrives, even mid-conversation.
This is not a personality flaw. It is a basic feature of how attention works, and it evolved because noticing gaps in knowledge was often genuinely useful.
Curiosity based scams exist purely to manufacture that gap, then offer a single click as the only way to close it. The subject line “you won’t believe what they said” is not information. It is a gap with a link attached.
The stronger the implied gap, the harder it is to ignore. A vague, unexplained warning pulls harder than a fully explained one, which is exactly why scam messages are written to explain almost nothing.
How Does Clickbait Engineering Turn a Headline Into a Trap?
Clickbait subject lines are not written carelessly. Every word is chosen to maximise the pull toward opening the message.
“Your parcel could not be delivered,” “Someone viewed your profile,” and “Your account has unusual activity” all share a structure. Each one implies something specific happened to you, without saying what.
Forbidden knowledge appeals push the same button harder. A message titled “Do not open this” or “Not meant for you to see” all but guarantees a click. Being told not to look is its own kind of gap.
Phishing attacks surged 4,151 percent after the launch of ChatGPT, according to Adaptive Security’s research published via Barracuda. Generative tools now let scammers mass-produce convincing, curiosity-triggering lure messages at a scale that used to require a whole team.
Free tools and reports work as the same trap in professional settings. A message offering a free salary benchmarking report, or a free tool that promises to check whether your own data has leaked, downloads malware the moment the file opens. Our guide to phishing, smishing and vishing breaks down how these messages arrive and what the warning signs look like across email, text and phone calls.
How Do USB Drives and QR Codes Turn Curiosity Into a Click?
Digital curiosity has an offline twin. A USB drive left in a car park, a lobby or a lift works on the same instinct as a clickbait subject line, just without a screen involved.
Plugging it in to see what is on it can silently install malware the moment the drive connects, often before anything visibly happens on the screen at all.
QR codes carry the same risk in a different shape. Criminals sometimes place a sticker over a genuine QR code, on a parking meter, restaurant table or EV charging point. The scan then redirects to a fake payment page that looks identical to the real one.
The FBI issued a formal warning about exactly this pattern at EV charging stations and parking meters. Criminals had placed fake stickers that sent drivers to fraudulent payment pages, capturing their card details.
Quishing, as QR code phishing is known, rose 587 percent through 2024 and kept climbing into 2025, with parking payments and package delivery notices the most common lures. Our guide to why that QR code on the wall could be dangerous covers how to check a code before you scan it.
Neither of these attacks needs you to be careless with security in general. They only need you to be curious once, at the one moment nobody is watching. Both are curiosity based scams wearing a physical disguise, not a fundamentally different threat.
What Is the One Habit That Stops Curiosity Based Scams?
Curiosity based scams rely on speed. The gap feels urgent, and the click feels like the fastest way to close it.
The one habit that reliably interrupts this is absurdly small. Before clicking any unexpected link, opening any unexpected attachment, or plugging in any found USB drive, pause and ask one question: who sent this, and why?
If you cannot answer both parts with something concrete, that gap is not yours to close by clicking. Leave the USB drive where you found it, or better, hand it to whoever manages the building.
Most digital attacks succeed not because of technical sophistication, but because someone acted quickly and automatically, before that one-second pause had a chance to happen. Our guide to the one-second pause and the habit that stops most attacks covers how to build this instinct into daily digital life.
Reporting a suspicious message costs nothing and helps others. The Anti-Phishing Working Group tracks phishing trends worldwide and accepts reports directly. Already clicked and lost money? Report it through India’s National Cyber Crime Reporting Portal or the 1930 helpline.
Frequently Asked Questions
Is it safe to plug in a USB drive I found to see who it belongs to?
No. Plugging it into your own computer or phone risks installing malware automatically, without any obvious warning sign.
Hand it to a security guard, building manager or the nearest lost-and-found instead.
How can I tell if a QR code has been tampered with?
Look closely for a sticker placed over the original code, especially on parking meters, charging points or delivery notices. A code that looks slightly raised or misaligned is worth avoiding.
Where possible, type the website address in directly instead of scanning, particularly for any payment.
What This Comes Down To
Curiosity based scams work by manufacturing a gap in what you know, then offering a single click as the only way to close it.
Wanting to know is not a weakness. It is one of the most ordinary things about being human, and it is exactly what these messages are built to use.
One habit protects you far more than caution in general ever could. Before you click, plug in or scan anything unexpected, pause for one second and ask who sent it, and why.
If this was useful, share it with someone who needs to know.
