Reciprocity, Incentive & Baiting

Reciprocity, incentive and baiting uses a perceived benefit, exchange, opportunity, useful resource, convenience, belonging, or curiosity trigger to encourage interaction. These lures may also be combined with urgency, fear, authority, or other pressure.

The offer can be commercial, professional, social, practical, or physical. A prize, job opportunity, free tool, exclusive group, shortcut, investment return, helpful intervention, or found object may lead the target toward a login, download, payment, disclosure, approval, installation, or device interaction.

Reciprocity, incentive and baiting can be assessed by asking:

• What benefit, exchange, opportunity, convenience, or curiosity trigger is being offered?
• What action is required to obtain it?
• Is the offer legitimate and is the requested action safe?
• What organisational channel or process should be used to confirm it?

---

Techniques

Reciprocity, Incentive & Baiting includes the techniques below. Select a technique to open its behavioural method, common examples, relevant taxonomy boundaries, and control-domain orientation in the Technique Catalogue.

• SE-T012.001 — Quid Pro Quo Exchange — Offering assistance, benefit, or service in exchange for action, information, credentials, approval, or access.
• SE-T012.002 — Curiosity Baiting — Triggering curiosity, intrigue, uncertainty, or novelty to encourage unsafe interaction.
• SE-T012.003 — Reward & Prize Incentives — Offering prizes, rewards, discounts, gifts, or exclusive access to reduce scrutiny.
• SE-T012.004 — Opportunity & Career Incentives — Exploiting ambition, professional opportunity, recognition, or career interest.
• SE-T012.005 — Free Resource & Download Lures — Offering files, tools, resources, templates, or downloads that appear useful or beneficial.
• SE-T012.006 — Physical Baiting — Using physical objects or environments to encourage unsafe interaction or access.
• SE-T012.007 — Belonging & Community Access Incentives — Offering membership, group access, social status, inclusion, or admission to a community as the benefit for engaging.
• SE-T012.008 — Convenience & Shortcut Lures — Offering an easier, faster, or lower-friction route so the target chooses an unsafe shortcut.
• SE-T012.009 — Scarcity & Exclusivity Incentives — Framing access, reward, or opportunity as rare, limited, selective, or exclusive.
• SE-T012.010 — Unsolicited Assistance & Rescue Framing — Presenting the attacker as able to solve, prevent, or relieve a problem so the target accepts their guidance or access.
• SE-T012.011 — Investment & Financial-Gain Baiting — Promising financial return or investment opportunity to induce the target to transfer funds, credentials, or access.

---

Behavioural Indicators

Reciprocity, incentive, and baiting activity may involve one or more of the following behaviours:

Offer and incentive presentation

• offering rewards, prizes, discounts, gifts, benefits, access, or opportunities without a clear prior relationship
• promising high or “guaranteed” financial returns, exclusive investment access, or fast profit to induce the target to invest or transfer their own funds
• presenting a resource, file, tool, template, download, job opportunity, or invitation as useful, exclusive, free, urgent, or personally relevant
• framing the interaction as a fair exchange, favour, reward, shortcut, or mutual benefit
• making the target feel selected, recognised, lucky, helped, included, or personally considered

Curiosity and interaction triggers

• using vague, sensational, unusual, leaked, confidential, personalised, or mystery-themed language
• placing physical objects such as USB drives, devices, access cards, QR stickers, flyers, or promotional items where people may interact with them
• using QR codes, links, attachments, mobile workflows, or downloads to hide the real destination or action
• encouraging the target to inspect, scan, plug in, open, run, approve, or download something

Request and workflow behaviour

• asking the target to log in, approve consent, approve MFA, install software, open a file, scan a QR code, provide personal information, disclose business details, or use a shortcut
• presenting an unofficial path as faster, easier, more helpful, or more convenient than normal process
• offering unsolicited support, troubleshooting, rescue, or assistance that leads to remote access, credential entry, code sharing, download, or approval
• moving the interaction toward channels, portals, files, or devices outside normal organisational controls

Pressure and manipulation behaviour

• creating gratitude, obligation, excitement, curiosity, scarcity, convenience pressure, or fear of missing out
• suggesting the target should respond because they have received help, a favour, a gift, an opportunity, or special access
• pairing reward or opportunity framing with urgency, exclusivity, or limited availability
• discouraging verification by making the interaction feel harmless, beneficial, informal, or low-risk