/hack
The Basics
Social engineering is a nice way of saying con game. You're looking to convince one or more people that you're somebody you're not. Somebody they can trust, at least as far as this situation.
People are reassured by people who are like them. If they're in charge of administering access to a server room, there's a good chance that they're up to their eyeballs in bureaucracy. If you're trying to get in to the server room, a reasonable approach is that you're new, and your boss (whose name you picked up from a little research into the company) needs you to power cycle the development server.
Another good method, if you can engage the mark in conversation, is to let them know that you share similar political or religious views. The first step is to look for a clue to their views. If your mark has a bible in their office, a casual reference to the will of God is a good intro. You'll know if this is a useful avenue of approach if the mark then takes a tangent in the conversation to talk about this issue. If it doesn't go anywhere, drop the issue and look for another clue.
Bungle in the Jungle
The biggest social engineering compromise in recent memory happened in the jungles of Columbia, when Army commandos rescued a large party of prisoners. They did it by using social engineering on a grand scale.
The first step was to infiltrate the FARC, a rebel group which has been at war with the Columbian government for decades. Being professionals, they aren't exactly revealing their techniques to armchair spies like me. But part of the way they established their credibility was by showing up in Che Guevara shirts. It obviously took more than some tshirts with a dead revolutionary on them to infiltrate the FARC, but it reinforces the idea of establishing a common thread is key to the con game.
The Financial Con
In role playing we tend not to spend a lot of time exploring commercial interests. If you're interested in introducing espionage and general skulduggery into your game though, there's nothing like a little social engineering to part some fool from his money. Or ideally, several fools.
By now we're all familiar with the Nigerian money laundering scams. These are fairly innocuous, in that only the extremely credulous would fall for something like this. This type of scam relies on people's desire to get something for nothing more than putting a little trust in someone. That's an old type of scam, but an obvious one. Here in the U.S. the government runs public service announcements warning people about these sorts of deals.
A more sophisticated scam looks like a legitimate investment, as long as the investors don't dig too deeply. It takes slightly longer to set this kind of thing up, but you'd be surprised at how quickly it can be done, and how little initial capital is needed.
In this kind of scam, the mark needs to be somebody who is less sophisticated about investments than they think they are. They won't fall for the something for nothing type scams, but they won't do the sort of due diligence investigation that a more sophisticated investor does.
The two most obvious things about this kind of scam are the sort of confidence building tactics that I described under basics, and a fair bit of effort into building a sense of urgency. The con man (or possibly team) will typically have some physical assets, or at least claim to have them. They will be able to offer examples of people or organizations that they're doing business with, and everything will seem to be on very short time frames. Small now but growing rapidly. These are all signs of the con.
The Electric Con
Social engineering is often a big part of a successful technological attack. In my inaugural article I mentioned that I used wedding photos to deliver a custom tailored virus to a client I was doing a security audit for. The payload was disguised as wedding photos. Although the virus itself didn't penetrate their system, the social engineering side of things worked perfectly. When the company's email virus scanner stripped out my payload, several of the targets contacted me asking for another way to get the file that didn't set off the virus scanner.
Another very useful tactic for electronic cons is taking advantage of people's trust in third parties. People who have spent large amounts of money on security software tend to put a lot of faith in that software that it will catch any threats. It won't though. A lot of software only targets certain classes of threats, and others only go for a set of known threats. That often leaves the door open for custom written threats. A character with a professional level of programming skill could write a bespoke virus, and then another team member could apply their social engineering skills to get the payload successfully delivered to the victim.
Taking It To The Table
Chances are good that most of your players aren't that adept at social engineering. They haven't seen confidence games, and have probably not talked their way into a controlled facility. That means you're going to have to fake it for them, so that they still get the feel of the thing without having to take a crash course in grifting.
For a high level approach to a con, use your game's equivalent to a fast talk roll. If your system doesn't have a fast talk skill, an attribute test against intelligence is an alternative.
The fun comes when you actually try to roll play the social engineering. Unless you have experienced cons in your group, you'll probably need to spoon feed them the situation. You'll start by doing a little pre-planning about the mark.
Plot out two or three major influences in their life, for good or ill. For instance, you might have a clerk whose major influences in her life are the bureaucracy at work, her dogs, and the fortunes of the Detroit Red Wings.
Now, when the characters are trying to engineer their way past this clerk, you can give them intelligence or perception rolls to pick up on any of the clues. If your group can get into the role playing very quickly, and you feel like your acting chops are up to it, it can be fun to act out the encounter. Otherwise, see how they want to play the scene. Do they present themselves as junior associates at a big defense firm trying to confirm background on a client? Do they talk about the prospects for the upcoming season and try to get her to come out to have drinks and watch the preseason game against Toronto tonight? Do they ask her about her labs, and does she hunt with them? It would be good, by the way, for the characters to have done a little research on the criminal defense firm they're claiming to be from, and be able to drop the name of the partner that they're working for.
The Con as Background
A con makes great material to act as the driver for an adventure. The victim of a con might be out for revenge. Somebody ruined by investments in phony corporations might kill themselves, possibly even their whole family. That can leave a huge mess to clean up (and not just for the crime scene cleaning company). It may be that none of the survivors know anything about how the ruin came about, and they'll need the characters to investigate.
If you have an established campaign you can add some excitement by making the players the target of a con, or witnesses to a con going down on somebody close to them. The can then try to con the cons, protect their friend, or arrange for the cons to have bad accidents in dark alleys.
The characters may wish to pull off a con as a way to ruin an adversary. You'll either need to have some tremendous acting skills and very talented players, or you're going to need to set the scenario up for them, present them with a workable plan for a con and let them play through the execution of it. Of course, a story is no good if everything goes smoothly, so you can give them some excitement by having the plan start to unravel. The family lawyer may want to perform Due Diligence, and his influence (and possibly he) needs to be neutralized before it blows the whole thing up.
Conclusion
The confidence game, also known as social engineering, is a great way to add an espionage flavor to your game. The beauty is that you can implement it at multiple levels. You can use it for the quick encounter to get some information or access a resource. You can use the same concepts for a whole adventure or even a whole campaign.
With a little prep on the part of the game master, you can go a long ways to impressing your players with the depth of your campaign, and of your duplicity. For a game master, those are both very good things.
