The Request That Fits

## The taught model of a lure Most people carry a mental picture of a phishing message assembled from awareness posters: a shouted deadline, a threat of account closure, a chief executive who needs a favour in the next ten minutes, a tone of manufactured panic. That picture is not wrong about what many messages look like — it is wrong about why those messages look that way, and therefore wrong about what a competent lure looks like. Pressure cues do real work. Urgency compresses the time available for thought; authority discourages the recipient from checking sideways; fear narrows attention to the demanded action. But all three share a weakness: they only apply pressure to a decision the recipient is actually making. They are levers on deliberation, and they announce their own presence. The moment a recipient notices that they are being hurried, the lever has been named and it stops pulling. ## The request that fits The stronger construction removes the deliberation instead of pressuring it. The operator asks for something the recipient already does on a schedule: re-approve the weekly export, resend the report link, confirm the standing distribution list, sign off the same routine item they signed off seven days ago. There is no invented deadline because the calendar already supplies one — it is Thursday, and Thursday is when this happens. There is no invented authority because the person asking is the person who always asks. Run the test on the recipient's side. What deviates? Not the sender, if the message comes from the mailbox they always correspond with. Not the topic. Not the tone. Not the timing. Not the action requested, which the recipient can perform from memory. The whole set of features a person is coached to notice is absent, and their absence is not an oversight by the operator — it is the design. ## What the operator pays for it The substitution is real work, not a free upgrade. To ask for the Thursday task, an operator has to know that the Thursday task exists, who performs it, what it is called internally, and roughly what the last one said. That knowledge is not always expensive to obtain — a shared calendar, a role description, or a thread the operator can already read will hand it over — but it has to be obtained. Pressure cues are what an operator uses when they have none of that context; the fitted request is what they use when they do. ## Why the outcome looks like nothing happened This is the part candidates most often miss. When the fitted request succeeds, the recipient does not make a mistake. They perform their ordinary task competently, exactly as they were trained to, and the task completes normally. The harm sits in a detail of the ordinary task that the operator changed — where the output was sent, which address the reply reached, which list received the file — not in the recipient behaving oddly. Afterwards the recipient can honestly say they did nothing unusual, and they are right. Any account of the event that ends in 'the user was careless' has misread it. ## What follows for how you reason about this Three consequences are worth carrying into an interview answer. First, calmness is not evidence of legitimacy. A well-written, low-pressure, on-schedule message is not a safer message; on the cost curve it sits above the shouty one, not below it. Second, the feature that distinguishes a fitted request from the genuine one is not in the message at all. If the message is a genuine continuation of a genuine conversation, reading it harder produces nothing. The distinguishing feature is in what the requested action can accomplish and where that action is performed. Third, this is why control classes that remove the dependency beat control classes that improve the recipient's judgment. The fitted request depends on the action being completable inside the conversation. If the standing instruction or the destination can only be changed in a system where the counterparty authenticates as themselves, the perfectly built message has nowhere to land — and the operator's research budget bought nothing. ## The one-line version Urgency and authority are levers on a decision. The request that fits removes the decision. That is a stronger position for the operator, and it is invisible to anyone screening messages by how they feel.