Authority bias
Authority bias is the tendency to give undue weight to a claim or instruction because it appears to come from someone with status, expertise, or power.
Why an apparent authority can be persuasive
It can be harder to question an instruction from an executive, official, or specialist than one from an unknown person. Attackers exploit that deference through impersonation, often adding urgency or secrecy.
The NCSC identifies claimed authority as a recurring feature of scams. The FBI has also documented impersonation of senior US officials using text and AI-generated voice messages.
Following a legitimate instruction is not automatically authority bias. The problem is letting someone’s apparent status outweigh the checks and permissions needed for the request.
Make verification part of the job
Make it normal for employees to check a senior person’s request. If the requester cannot be reached, staff need to know who can review the request and whether it must wait.
Knowing who asked is only one part of the decision. Authorization still matters: a director cannot necessarily approve access to every system or release every document.
In an incident review, establish which instruction was given and which checks were missed. Avoid calling someone gullible based on one decision. The process should let people question requests made in a familiar voice without having to challenge a senior colleague’s status.