The World's Greatest Detective Was Also the World's Greatest Con Artist

Key points

• Elizabeth Rasnick, an assistant professor at the University of West Florida's Center for Cybersecurity and Artificial Intelligence, presented at DEF CON 34 in Las Vegas.
• She argued that trust, not technology, is the core "attack surface" that criminals exploit in social engineering schemes.
• Social engineering, which means manipulating people rather than machines to hand over information or access, predates the internet by centuries.
• Rasnick compared ethical hackers (hired to test defences) to Sherlock Holmes, and criminal hackers to his archnemesis Moriarty, noting the techniques are identical and only intent separates them.
• Artificial intelligence now lets criminals send more convincing fake messages at greater scale, but the underlying psychology has not changed.

Elizabeth Rasnick walked onto the DEF CON stage wearing a green deerstalker cap, a plaid shawl, and a pipe. She looked, deliberately, like Sherlock Holmes.

The disguise was the argument.

Rasnick, an assistant professor at the University of West Florida's Center for Cybersecurity and Artificial Intelligence, used the costume to open a session on social engineering, which is the practice of manipulating people through deception rather than hacking into machines directly. Her central claim: Holmes was doing it in Arthur Conan Doyle's stories long before anyone had a computer.

What is social engineering, and why does it keep working?

Social engineering works because human psychology is predictable. Criminals study a target, build a believable cover story, create pressure or excitement, and then watch how people react.

"Predictable behavior is what makes social engineering possible," Rasnick told the audience. Trust, she said, is the real attack surface, meaning trust is the vulnerability criminals actually exploit, not a software flaw or a weak password.

The tactics she listed map almost perfectly onto Holmes's own methods in the stories: know your target, become believable, create a reason to act, exploit emotion, observe reactions, adapt when something does not work.

In the story "The Red-Headed League," a fake organisation lures a man away from his shop so criminals can tunnel beneath it. Rasnick compared that directly to fake job-posting scams today, where criminals post convincing-looking vacancies, wait for applicants to reply, and then send phishing links, which are fake web pages designed to steal login details or install harmful software.

Holmes, in the original tales, once got engaged to a housemaid while undercover to gather information. Criminals today use AI-generated deepfake videos, realistic fake voices, and mass-personalised emails to do the same thing at scale.

Does AI change anything?

It changes the speed and the volume. Artificial intelligence lets criminals write phishing emails that sound personal and polished, removing the spelling mistakes that used to give scams away. It helps them send thousands of tailored messages in the time it once took to write one.

But the underlying logic is unchanged. Fear and curiosity still drive people to click. A message that says "your account will be closed in 24 hours" works today for the same reason Holmes's urgency tactics worked in the 1890s.

Is there a difference between a criminal hacker and an ethical one?

Yes, and Rasnick was precise about it. Ethical hackers, sometimes called penetration testers, are hired by organisations to break into their own systems and find weaknesses before criminals do. They sign contracts beforehand and deliver written reports at the end.

"The difference is paperwork," Rasnick said.

To illustrate the point, she opened her talk with a quiz, asking the audience to identify which actions Holmes or Moriarty took. Everyone guessed wrong. Holmes did the reconnaissance, the manipulation, the impersonation. His fictional villain was comparatively innocent.

"Does it make it better when Holmes does it?" she asked. "The difference is intent and whether you have legitimacy."

What should ordinary people watch for?

Any message that makes you feel urgent, curious, excited, or scared deserves a pause. Criminals design those feelings on purpose. Before clicking a link or handing over information, check whether the request arrived through a channel you initiated, and if in doubt, call the organisation directly using a number you find yourself.

Common questions

Why can't spam filters and security software just stop social engineering?

Software catches technical attacks well, but social engineering targets the person, not the machine. A convincing phone call or a well-written fake email reaches a human being before any filter can judge it.

What makes someone easier to manipulate?

Rasnick's framework points to two things: being time-pressured and being curious. Criminals create both on purpose. Slowing down, even for thirty seconds, interrupts the psychological mechanism they are counting on.