Baiting vs phishing: who moves first? With phishing the attacker does, by sending you something. With baiting they leave something lying around (a USB stick in the car park, a free download, a parcel) and wait for you to pick it up.
That difference matters more than it sounds. With baiting, nothing lands in an inbox, so there’s nothing for a filter to scan. The victim does the risky part themselves.
| Phishing | Baiting | |
|---|---|---|
| Who starts it | The attacker sends a message | The victim picks something up |
| Typical lure | An account alert, an invoice, a shared document | A found USB drive, a free gift, a too-good download |
| Channel | Email, text, chat | Often physical: car parks, desks, the post |
| What gets past | Email filters, if the message is good enough | Everything network-based, because nothing is sent |
| A case from this library | Target (2013): an email to a contractor | UIUC experiment (2015): 297 USB drives left around campus |
| What stops it | Filters, link checks, phishing-resistant MFA | USB device controls and an easy way to hand in found items |
Key takeaways
Most people have been told not to click strange links. Far fewer have been told what to do with a USB stick they find in the car park. And the instinct to plug it in isn’t always nosiness. Often it’s helpfulness: someone wants to find out who lost it.
Baiting also skips the parts of a company’s defenses that deal with messages. No email arrives, no link gets scanned. The device just gets connected to a work computer by someone who means well.
Researchers from the University of Illinois, the University of Michigan and Google left 297 USB drives at 30 spots across the Illinois campus. The drives held harmless files that reported back when opened. Up to 98% were picked up, 45% were plugged in and had files opened, and the first connection came in under six minutes. Full case: UIUC USB drop experiment.
An infected flash drive inserted into a US military laptop let a worm called agent.btz spread onto classified networks. The cleanup took about 14 months, led to a worldwide ban on thumb drives across the military, and helped spur the creation of US Cyber Command. Exactly where and how the drive was inserted is still disputed. Full case: Operation Buckshot Yankee.
The FIN7 crime group mailed packages containing malicious USB devices to HR, IT and executive staff at US retail, restaurant and hotel companies. Plugging one in was meant to install malware automatically. One recovered package came with a forged Best Buy gift card letter. Full case: FIN7 BadUSB mailings.
Tip: if you find a USB drive, a cable or a “free” device at work, don’t plug it in to see whose it is. Hand it to IT or security. That’s the helpful thing to do.
See the physical social engineering cases, the USB drop attack page and the phishing cases.
Not really, though they’re cousins. Phishing turns up uninvited. Bait just sits there until someone takes it. A dodgy “free” download is the closest the two get, and even then the victim went looking.
A USB drive labelled “Salaries 2026” left in a company car park. In the 2015 Illinois study, the drives held files made to look like resumes, photos, exam papers or confidential documents, and nearly half got opened.
No. Free software, pirated films and fake gift offers online work the same way: something tempting that the victim chooses to download. The physical version is just harder for security tools to see.
Baiting offers an object or a freebie. Quid pro quo offers a service in exchange, like a fake IT technician offering to fix a problem if you give them your login. See baiting vs quid pro quo.
Reviewed by the SEE Team on 22 October 2026; every case linked here has its sources on its own page. How pages are researched and fact-checked. About Social Engineering Examples.
Social Engineering Examples