DEF CON 27 Social Engineering Village Notes

R Paul Wilson - The Real Hustle: Insights from a Professional Scam Artist

Notes By Aryan Giri

Speaker: R Paul Wilson, creator and star of "The Real Hustle"

Context: Impromptu talk about his experiences with cons, scams, and social engineering

Key Focus: How scams work in practice and the psychology behind why people fall for them

Introduction & Background

R Paul Wilson began his fascination with cons and magic at age 8. His career evolved from performing magic to studying and demonstrating real-world scams.

Key Insight: Wilson believes he might be in a simulation because "life allowed me to perform more cons and scams than any other human being in history."

Career Milestones:

Early Experiences & Learning

Personal Cheating Experiments:

"Here I am the leader of the gang who can't cheat straight."

This experience taught him that cheating wasn't a viable career path and could lead to serious consequences.

Offensive Security Application: Understanding that even imperfect execution of social engineering can still yield results. Red teams should focus on the psychological principles rather than perfect execution.

The Real Hustle TV Show

The show involved performing real scams on unsuspecting people, then revealing they were part of a TV show.

Important Note: All scams were performed for real money with real victims who didn't know they were on TV until after the scam was complete.

Notable Scams Demonstrated:

The "Bouncer" Scam

Method:

  1. Sell cheap items (pens) for £5 to gather a crowd
  2. Ask if customers are happy, then refund their money
  3. Repeat with progressively more expensive but still worthless items
  4. At the final high-priced item (£50 watch), take the money and leave

Psychology: People expected the pattern to continue and thought they'd get even bigger items (PlayStations, TVs) for free.

Red Team Technique: Creating patterns of trust then breaking them at the optimal moment. This can be applied to phishing campaigns where initial harmless emails build trust before the malicious payload.

Camera Lens Theft

Method: Use a distraction (asking for directions with a map) while quickly twisting and removing the camera lens.

Escape Tactic: When caught, use the line "I'm with the BBC" which surprisingly worked to defuse situations.

Physical Security Testing: Distraction techniques combined with authority claims can bypass even alert security personnel. Useful for testing physical access controls.

Counterfeit Money Switch

Method: Pay with real money, receive change, then request different denominations while switching in counterfeit bills.

Rescue Operation: When celebrity guest Caprice was caught, Wilson and his partner posed as police to extract her and recover evidence.

Incident Response Evasion: The ability to quickly assume authoritative roles during security incidents can help red teams extract themselves from compromised situations during physical assessments.

Favorite Scams & Psychological Insights

The "Razzle" (Carnival Game)

Considered Wilson's favorite scam because it's mathematically impossible to win but psychologically compelling.

How it works:

  • Players throw marbles into a numbered box
  • Only specific totals win points
  • When players hit "29", they must double their bet
  • This continues until players run out of money
  • Operator then offers to hold their winnings if they get more money

Key Insight: The game was so effective in Blackpool that it had to be made illegal as people would lose their entire vacation budget in days.

Progressive Engagement: This technique can be applied to social engineering by starting with small requests and gradually escalating to more significant access or information. The sunk cost fallacy keeps targets engaged.

Three-Card Monte

Wilson demonstrated this classic street scam and explained its mechanics:

  • Uses psychological manipulation rather than pure sleight of hand
  • Includes "mid-air switches" where cards are swapped during throws
  • Even when you know how it works, it's difficult to beat
  • Operators will stop cheating if they sense you know the game
Adaptive Social Engineering: The ability to detect when a target is aware of manipulation attempts and adjust tactics accordingly is crucial for successful red team operations.

Key Psychological Principles for Social Engineering

Authority & Perception

Simple props like yellow fluorescent jackets create automatic authority. People assume you're official and will follow instructions.

Pattern Recognition & Expectation

Scams work because people expect patterns to continue and anticipate bigger rewards based on previous experiences.

Empathy as a Tool

Gaining empathy and returning it is one of the most powerful social engineering tools available.

Critical Insight: "Con artists know already how to con you. The reason they get away with it is because you don't know how they operate and you don't recognize it as a scam."

Red Team Applications & Offensive Security Focus

Social Engineering Techniques for Security Testing

Physical Access Testing

  • Use of authority props (high-vis vests, fake IDs)
  • Distraction techniques for tailgating
  • Misdirection for device placement

Phishing Campaign Design

  • Progressive engagement strategies
  • Pattern establishment and breaking
  • Authority exploitation in communications

Pretext Development

  • Creating believable backstories
  • Leveraging empathy and reciprocity
  • Adapting to target responses

Key Takeaways for Security Teams

Red Team Advantage: Most organizations focus on technical defenses, leaving significant gaps in human-factor security. Social engineering testing often reveals the most critical vulnerabilities.

Practical Security Applications

Upcoming Training (February 2020, Orlando)

Wilson teased techniques he would teach at the Social Engineering Village training:

"I'm going to apply some of that to some things that you may want to do in real life... to have the tools required to distract and gain an advantage in certain situations."
Operational Security: These physical techniques can be invaluable for red teams operating in hostile environments or during physical security assessments where device confiscation is a risk.

Summary & Key Lessons

Most Important Takeaways:

  1. Social engineering works because it exploits fundamental human psychology, not intelligence
  2. Patterns of trust can be established and exploited effectively
  3. Authority is easily fabricated and rarely questioned
  4. Empathy and reciprocity are powerful manipulation tools
  5. Adaptation to target responses is more important than perfect execution
  6. Understanding these principles is crucial for both attack and defense
Final Thought: "The best defense against social engineering is awareness of the techniques being used against you. Once you recognize the patterns, you can't be easily manipulated."