{"id":471,"date":"2024-11-24T14:48:43","date_gmt":"2024-11-24T13:48:43","guid":{"rendered":"https:\/\/www.c-sautter.de\/?p=471"},"modified":"2026-10-16T08:18:33","modified_gmt":"2026-10-16T06:18:33","slug":"psychologie-hinter-cyberangriffen-warum-selbst-klare-warnungen-ignoriert-werden","status":"publish","type":"post","link":"https:\/\/www.c-sautter.de\/en\/psychologie-hinter-cyberangriffen-warum-selbst-klare-warnungen-ignoriert-werden\/","title":{"rendered":"The Psychology Behind Cyberattacks: Why Even Clear Warnings Get Ignored"},"content":{"rendered":"
\n
\"Smartphone<\/figure>\n<\/div>\n\n\n

As an IT specialist, I often have acquaintances and friends ask me for advice on technical problems. But recently I had a case that kept me thinking for a long time, from both a technical and a psychological point of view \u2013 and that shows why even obvious threats are often ignored.<\/p>\n\n\n\n

\n\n\n\n

The Moment of Alarm<\/h2>\n\n\n\n

It started with a WhatsApp message from an acquaintance:<\/p>\n\n\n\n

"I can't access my banking right now because I have a virus. I don't know what to do."<\/em><\/p>\n\n\n\n

For me the matter was immediately clear: The device must be turned off immediately.<\/strong> A compromised device should not be used any further, as every further action gives an attacker more information and control. My answer was therefore direct: \u201cTurn off the phone and have it analyzed!\u201d<\/em><\/p>\n\n\n\n

But what happened? My friend ignored my advice. The device remained active for several days while he tried to "carry on as normal". His assumption: "I'm not doing anything critical. No banking, just YouTube and chatting."<\/p>\n\n\n\n

\n\n\n\n

The Psychology Behind It: Why Warnings Are Ignored<\/h2>\n\n\n\n

From a technical perspective, it was clear to me that this negligence represented an enormous risk. But why do people act so irrationally in such situations? The answer lies in a combination of psychological mechanisms that attackers often deliberately exploit:<\/p>\n\n\n\n

    \n
  1. Denial:<\/strong>
    Threats that cannot be directly seen or felt are often ignored. The thought \u201cI won\u2019t be affected\u201d is widespread \u2013 a classic example of the so-called optimism bias.<\/li>\n\n\n\n
  2. Underestimating the danger:<\/strong>
    Many people think that cyberattacks only affect large companies or celebrities. They believe that they are "too insignificant" to be the target of an attack. My friend thought that as long as he didn't use online banking, there was no risk.<\/li>\n\n\n\n
  3. Illusion of control:<\/strong>
    There is a widespread assumption that you are in control of the situation as long as you avoid certain things (e.g. banking). What was overlooked here is that an attacker already had full access to the device.<\/li>\n\n\n\n
  4. Convenience:<\/strong>
    The idea of turning off the phone, no longer being able to read messages and having to adjust daily routines was apparently more unpleasant than the invisible threat posed by the virus. People tend to take the path of least resistance \u2013 even if it is harmful in the long term.<\/li>\n<\/ol>\n\n\n\n
    \n\n\n\n

    The Consequences: What We Later Found Out<\/h2>\n\n\n\n

    A few days later, my friend finally had the device analyzed. The results were not surprising: two malicious apps, disguised as PDF readers and document readers, were reported as "malicious" by Google Play Protect. The attacker could have easily intercepted passwords, read messages, or even communicated on behalf of my friend \u2013 which may have already happened. A comprehensive analysis was no longer possible at this point, as phishing messages and various apps had already been deleted.
    Also interesting was the fact that several \u201cantivirus\u201d programs did not detect any problems \u2013 a false sense of security.<\/p>\n\n\n\n

    Fortunately, no real damage occurred in this specific case.<\/p>\n\n\n\n

    What would have happened if the device had been turned off immediately? The risk of real damage could probably have been minimized. But because of the delay and the continued use of the device, the attacker was able to consolidate control and possibly steal even more data.<\/p>\n\n\n\n

    \n\n\n\n

    What IT Specialists Can Learn from This<\/h2>\n\n\n\n

    This incident reminded me that technical knowledge alone is often not enough to convince people. Cyberattacks are not only a technological problem, but also a psychological one. As IT professionals, we should engage with the mindsets and reactions of average users in order to better support them.<\/p>\n\n\n\n

    Tips to Raise User Awareness More Effectively:<\/h3>\n\n\n\n
      \n
    1. Communicate simply and concretely:<\/strong>
      Technical details about malware or exploits may be correct, but they often scare off laypeople. Clear instructions help more, such as: \u201cTurn it off immediately and have it analyzed.\u201d<\/em><\/li>\n\n\n\n
    2. Make dangers tangible:<\/strong>
      Many people underestimate the consequences. It helps to give concrete examples or scenarios of what data misuse or identity theft could look like.<\/li>\n\n\n\n
    3. Emphasize urgency:<\/strong>
      People tend to put off dealing with threats. Phrases like \u201cEvery minute the device is on gives the attacker more control\u201d<\/em> can help convey the necessary urgency.<\/li>\n\n\n\n
    4. Show understanding:<\/strong>
      Convenience and denial are human. Instead of accusations, it is more helpful to explain empathetically why security measures are important, even if the threat is not visible.<\/li>\n<\/ol>\n\n\n\n
      \n\n\n\n

      The Media's Responsibility in Educating the Public<\/h2>\n\n\n\n

      The media have a central responsibility to inform the general public about the dangers of cyberattacks and security vulnerabilities. Unfortunately, reporting often focuses on spectacular cases such as large-scale hacker attacks or data scandals at prominent companies. The everyday risks that ordinary<\/em> people face \u2013 such as phishing emails, fake apps or insecure passwords \u2013 receive little attention by comparison. This gap in reporting means that many people underestimate the threat and feel poorly informed when they are suddenly affected themselves. Yet the media could help make the risks tangible through understandable explanations and concrete examples. Practical content \u2013 as shown in the YouTube videos below \u2013 is an effective way to promote security awareness. The media should focus more on such everyday topics and also offer clear recommendations for action in order to support an informed and security-conscious society.<\/p>\n\n\n\n

      \n\n\n\n
      \n