An authority bias scam does not usually need to hack anything. It just needs to sound official enough that you stop asking questions.
In 1961, psychologist Stanley Milgram asked ordinary volunteers to deliver what they believed were painful electric shocks to another person. The only reason they kept going was that a man in a lab coat told them to continue.
Most of them did. Not because they were cruel, but because someone who sounded like an authority told them to.
That same instinct sits behind every tactic in our guide to how scammers manipulate people, and it rarely needs a lab coat to work.
In 2025, callers posing as IT staff rang the help desks at Marks & Spencer, Co-op and Harrods. They asked for a password reset, and got it.
M&S alone lost an estimated £300 million in online sales. No malware appeared anywhere in the attack, and nobody cracked a single line of code.
An authority bias scam like this works on the strength of a voice that sounds like it belongs, whether that voice claims to be a bank, a police officer or your own IT department.
This post explains why that instinct is so hard to override, exactly how scammers manufacture authority from nothing, and the one habit that verifies any claim before you act on it.
Why Does an Authority Bias Scam Work So Well on You?
Most of us were taught from childhood to listen to people in positions of authority: teachers, doctors, police officers, employers.
That instinct keeps workplaces and communities functioning. It also means most people comply first and question later, exactly as Milgram’s volunteers did.
Pretexting, inventing a believable scenario to manipulate someone, now shows up in more than half of all social engineering incidents in data breaches. This is according to the US Cybersecurity and Infrastructure Security Agency. In plain terms, most of these attacks succeed because of a convincing story, not a technical trick.
An authority bias scam simply borrows this instinct. The caller does not need to convince you of anything complicated.
They only need to sound like someone whose instructions you would not normally question.
Teachers often present Milgram’s experiment as a lesson about obedience in a lab. That same mechanism applies just as directly to a workplace Slack message from someone claiming to be the CEO, or a phone call from someone claiming to be from HR during a routine audit.
Only the uniform changes. The mechanism does not.
How Do Scammers Manufacture Authority Out of Nothing?
Real authority takes years to earn. Scammers build the appearance of it in seconds.
A spoofed caller ID showing your bank’s real number, an official-sounding title, a police badge photo, or a logo copied from a real letterhead are often all it takes.
The scammers behind the 2025 attacks on M&S, Co-op and Harrods simply claimed to be colleagues from internal IT. Nobody at the help desk checked further.
The same pattern shows up impersonating CEOs asking finance staff for urgent transfers. It shows up as HR asking for login details during a fake audit. It shows up as a government official demanding compliance with a supposed investigation.
In India, this often takes the shape of a caller claiming to represent the local police station, a bank’s fraud department, or an income tax office.
The caller may already know your name, your city, or the last four digits of an account. None of that proves who they are. Often, criminals simply bought that information from an earlier breach.
The uniform, the title and the tone are all constructed. The person hearing them rarely checks any of it.
What Is Authority Stacking, and Why Does It Work Even Better?
Scammers rarely rely on a single authority signal. They stack several at once.
A call might open with a spoofed number matching your bank, add a job title, then reference a case number that sounds official. Each layer makes the previous one feel more credible.
This stacking is exactly what makes digital arrest scams so effective. A caller claiming to be police adds a fake arrest warrant, then a senior officer joins the video call to confirm the story.
By the time three or four signals have landed together, the victim has stopped questioning any single one of them. You can read more about how these specific calls escalate in our guide to digital arrest scams and how to shut them down.
Scammers often add fear as the next layer on top of authority. The two combine to collapse the time you would normally spend checking whether any of it is real.
Each additional signal is cheap for the scammer to add and expensive for you to question, since doubting one detail can feel like doubting all of them at once. That feeling is exactly the point.
How Do You Verify an Authority Claim Before You Act?
The single habit that breaks almost every authority bias scam is verification through a separate channel.
If someone calls claiming to be your bank, your employer’s IT department, or the police, hang up. Then look up the organisation’s number independently and call that instead.
Never use a number, link or callback option the caller themselves provides. They control that channel, not the organisation they claim to represent.
This applies just as much inside a workplace. If an urgent request arrives by email or chat from someone claiming seniority, confirm it by phone or in person before acting, especially where money or credentials are involved.
This same instinct affects people who consider themselves careful, since it exploits a bias rather than a lack of intelligence. Our guide to the brain tricks that make smart people fall for scams covers why this happens more broadly.
If you have already shared information or acted on a call like this, report it through the National Cyber Crime Reporting Portal or call the 1930 helpline. In the US, the FTC’s consumer advice hub offers the equivalent starting point.
Frequently Asked Questions
Can an authority bias scam fool someone who is naturally cautious?
Yes. Authority bias is a wired response, not a personality trait, so caution alone does not remove it.
The only reliable defence is independent verification, not confidence in your own scepticism.
How do I know if a caller claiming to be from my bank or the police is real?
Hang up and call the number listed on the official website or the back of your card, never a number the caller gives you.
A genuine bank or police officer will never object to you verifying this way.
Why do workplace authority scams keep succeeding even after staff training?
Because training addresses knowledge, while authority bias operates on instinct, and instinct reacts faster than a remembered policy.
A verification step built into the process, such as a mandatory callback for any fund transfer request, closes that gap far more reliably than awareness alone.
What This Really Comes Down To
Authority feels real in the moment, whether or not it actually is real.
The gap between hearing a claim and acting on it is where an authority bias scam either succeeds or collapses completely.
Build one habit. Verify independently, through a channel you found yourself, before you comply with anything.
It costs a few minutes, and it works every time, regardless of how convincing the voice on the other end sounds.
If this was useful, share it with someone who needs to know.
