S.M.M.

Stop Manipulating Me · A Field Guide to Psychological Influence

ENTRY No. T17.4
CATEGORY Time Pressure
CLEARANCE Public / Essential
EDITION 01
Dossier · Manipulation Tactic

Urgent Requests

Direct Pressure · Queue-jumping demand · Common
Red Flag
How It WorksSEC 01

Urgent Requests exploit the workplace convention that “urgent” means “handle this first, questions later.” By flagging a request as time-critical, an operator borrows the queue-jumping privilege urgency normally earns and uses it to leapfrog the very scrutiny that would expose a fraudulent ask. The tactic is the human-layer engine behind business email compromise, help-desk social engineering, and executive-impersonation fraud, which the FBI’s Internet Crime Complaint Center has for years ranked among the costliest categories of cybercrime by dollar losses.

The mechanism stacks two of Cialdini’s levers on top of time pressure. Authority supplies a senior name whose status discourages pushback; scarcity of time supplies the excuse to bypass process. Under a deadline, people shift from careful, rule-checking cognition to fast heuristic judgment — Kahneman’s System 1 — which is precisely where an off-process request can pass as normal. The urgency is not incidental to the attack; it is the component that disables the defense.

The reliable signature is a cluster, not any single element: urgency plus routing around the normal procedure plus a hint of secrecy. Genuine urgent business tolerates verification — a real executive expects you to confirm a wire, and a real IT desk expects you to follow policy. Manufactured urgency does the opposite: it treats your attempt to check as the obstacle. When a request pressures you to move fast, go off-process, and keep it quiet all at once, the pressure itself is the payload.

Warning SignsSEC 02
  • Urgency plus off-process. The request is both urgent and routed around the normal procedure — pay this now, outside the usual approval chain.
  • Secrecy attached. "Keep this between us" or "don't loop in the team" isolates you from the colleague who would catch the problem.
  • Borrowed authority. The urgency is backed by a senior name — an executive, an auditor, IT — whose status discourages you from pushing back.
  • New payment details. An urgent invoice, wire, or gift-card request arrives with changed account numbers or an unusual method.
  • Verification discouraged. Any suggestion to confirm through the normal channel is met with more pressure rather than cooperation.
  • Channel mismatch. The urgent ask arrives through a channel that person or department never uses for this kind of request.
Frequently Paired WithSEC 03
  • Business Email Compromise · T14.10
    Primary payload behind urgent-payment asks
  • Urgency-Based Credential Theft · T14.17
    Same wrapper aimed at logins
  • Rushed Verification · T17.12
    Pressures you to skip the checks
  • MFA Fatigue Attacks · T14.18
    Urgency applied to approval prompts
How the Attack UnfoldsSEC 04
  • Stage 01 · Flag
    A request arrives marked urgent — often backed by a senior name or authority — signaling it should jump ahead of normal work and normal scrutiny.
  • Stage 02 · Isolate
    Urgency is paired with off-process routing and a note of secrecy, separating the target from the colleagues or steps that would catch the anomaly.
  • Stage 03 · Extract
    Under time pressure the target fulfills the request — a payment, a credential, an access grant — before the standard verification that would have exposed it.
Counter-ProtocolSEC 05
Defense: Urgency plus off-process plus secrecy is a signature, not a coincidence — verify before you act.
  • Verify out-of-band. Confirm any urgent payment, access, or credential request through a known, independent channel — the person's real number, not the contact details in the message.
  • Hold the process. Urgency is never a reason to skip approval steps. Legitimate requesters expect controls; fraudsters need you to waive them.
  • Treat secrecy as the tell. "Don't tell anyone" is not how real urgent business works. Secrecy exists to remove the second set of eyes, so add one.
  • Slow the payment path. Apply callback verification and dual approval to changed bank details or unusual methods, exactly the cases urgency is used to rush.