I just discovered a disturbing real-world vulnerability by accident.
A couple hours after checking in to my hotel, I went back to the front desk and said "I need to add someone to my room because her flight gets in late this evening." The clerk asked my room number, and I told her and also said my name. A few seconds later, after asking me to spell the name to add, there's a new name on my room reservation. Nowhere in this process did she check my ID.
Did I accidentally socially engineer my way into adding an unrelated name onto a room reservation?
WeChat ID
aaronpk_tv
I think people in customer service are a lot more wary of not displeasing their customers — even more so in hotels with their guests. This fear does expose them to being prone to social engineering. I believe they are trained to quickly move on from the problem to the solution they can provide — makes them trust others easily. I hope they are also trained to not be careless doing that.