Baiting and Quid Pro Quo

Baiting and quid pro quo are two social engineering techniques that work by offering you something you want, so that you let your guard down and hand over what the attacker is really after.

Baiting

In baiting, the attacker dangles something attractive in front of you: a prize, a free gift, a free download, or a file you are curious about. The offer exists only to make you act before you think. Taking the bait might mean typing your login details into a fake claim form, or downloading a file that installs malware on your device.

For example, a USB stick is left on a bench outside a leisure centre with "Party photos – please return" written on it. Whoever plugs it in out of curiosity runs a hidden program from the stick that gives the attacker a way into the device. Nobody forced their way in — the victim plugged the attack in personally.

Quid pro quo

Quid pro quo means "something for something". The attacker pretends to offer help or a service — speeding up a slow computer, resetting a password, giving technical support — and asks for your information or access to your system in return. The offer sounds helpful, which is exactly why it slips past your suspicions: you believe someone is doing you a good turn.

For example, a player in an online game is messaged by someone offering to level up their account overnight for free — hours of play done for them while they sleep. There is just one condition: send over the username and password so the "helper" can log in. The favour is the trade; the account is the prize.

Comparing the two