Urgent Requests exploit the workplace convention that “urgent” means “handle this first, questions later.” By flagging a request as time-critical, an operator borrows the queue-jumping privilege urgency normally earns and uses it to leapfrog the very scrutiny that would expose a fraudulent ask. The tactic is the human-layer engine behind business email compromise, help-desk social engineering, and executive-impersonation fraud, which the FBI’s Internet Crime Complaint Center has for years ranked among the costliest categories of cybercrime by dollar losses.
The mechanism stacks two of Cialdini’s levers on top of time pressure. Authority supplies a senior name whose status discourages pushback; scarcity of time supplies the excuse to bypass process. Under a deadline, people shift from careful, rule-checking cognition to fast heuristic judgment — Kahneman’s System 1 — which is precisely where an off-process request can pass as normal. The urgency is not incidental to the attack; it is the component that disables the defense.
The reliable signature is a cluster, not any single element: urgency plus routing around the normal procedure plus a hint of secrecy. Genuine urgent business tolerates verification — a real executive expects you to confirm a wire, and a real IT desk expects you to follow policy. Manufactured urgency does the opposite: it treats your attempt to check as the obstacle. When a request pressures you to move fast, go off-process, and keep it quiet all at once, the pressure itself is the payload.