Quid pro quo attacks are not a new form of social engineering. However, in 2025, they have gotten more sophisticated then ever.
In this guide, we will cover what quid pro quo attacks are, how to spot them, and how to avoid falling victim.
If you want to learn more about social engineering attacks, check out our email security and privacy awareness course.
What is a Quid Pro Quo attack?
A quid pro quo attack is a social engineering technique where a hacker promises a profit in exchange for information that can later be used to steal money, and data, or take control of a user account on a website.
The term “quid pro quo” comes from Latin and literally means “something for something”. You give me something, I give you something.
Similar phrases include “a favor for a favor”, “give and take” and “you scratch my back, and I’ll scratch yours”. In essence, they all mean that there is an agreement between two parties for an exchange of goods or services.
This notion of exchange is crucial because we obey the law of psychological reciprocity as human beings. This means that whenever someone gives us something or does us a favor, we feel obliged to return the favor.
So, how do attackers use this concept in a social engineering context?
Here’s a very simple scenario:
- you are contacted by an (alleged) IT employee who offers to perform an audit on your computer ;
- he offers to remove potential viruses that could lower your computer’s performance;
- but to do this, he needs your login and password;
- you provide them without question.
Boom! You have just fallen victim to a quid pro quo attack.
Quid pro quo attacks are based on manipulation and abuse of trust. As such, they fall into the category of social engineering techniques, such as phishing attacks (including spear phishing and whaling attacks), baiting or pretexting.
Quid Pro Quo Attacks: Real-World Examples
Let’s now look at some cases of quid pro quo attacks, and what we can learn from them.
Axie Infinity cryptocurrency scam
In 2022, Business Insider reported one of the largest cryptocurrency scams to date. The attack, based on the quid pro quo technique, resulted in the theft of $617 million.
Hackers associated with North Korea’s Lazarus Group executed a sophisticated attack on Sky Mavis, the developer of the NFT-based game Axie Infinity. Posing as recruiters on LinkedIn, they targeted a senior engineer, engaging him in multiple fake job interviews. After these interviews, the engineer received a fraudulent offer letter embedded with spyware.
Upon downloading this fake offer, the attackers gained access to the company’s blockchain network, which facilitates the transfer of Ethereum-based cryptocurrencies in and out of the game. From there, the attackers were able to siphon off millions of dollars in cryptocurrency.
The rise of tech support scams
During the pandemic, and with the rise of remote work, there has been an increase in phony tech support frauds.
In this form of quid pro quo, attackers pose as IT support personnel, offering assistance to employees. In exchange for this “help,” they request login credentials. They can also direct victims to install malicious software, compromising the organization’s security.
This scamming technique uses a combination of quid pro quo and “vishing”. Vishing is a form of social engineering that combines “voice” and “phishing”. It refers to phishing scams done over the phone.
In December of 2024, the FBI reiterated warnings, especially toward the elderly. Here’s a quick summary of how these attacks unfold according to the FBI:
- scammers contact victims posing as tech support from a legitimate company (Microsoft, McAfee, Norton, etc.), pretexting that there is an issue with their device;
- the victim is asked to call back a number and assured the problem could be resolved. However, the attacker then tells his victim that their financial accounts have been hacked. For security purposes, they should immediately move their money to a third-party account;
- victims are then instructed to sell assets, purchase gold (to be picked up by a courier), or wire money to other accounts under the control of the scammers.
If you want to learn more about these types of tech support scams in a fun and entertaining way, we highly recommend you check out the YouTube channels Scammer Payback and Kitboga.
What can we learn from these quid pro quo attacks?
So, what can we learn from these examples of quid pro quo attacks?
Firstly, don’t trust – verify.
The phrase is derived from an old Russian proverb that states, “Trust, but verify.” The idea is that you should never blindly trust what someone says, but you should always verify their claims.
The Axie Infinity hack for example illustrates how attackers can create highly targetted and hyper-personalized attacks. This is why any form of unsollicited job offer (or unsollicitated communication) should be verified. You can ask for identities, job roles and double-check those on the official company website.
Secondly, never share sensitive information over the phone or email.
Employees working remotely are prime targets for attackers posing as IT support personnel. Remember that official IT personnel will never ask for your password, credit card number etc. by phone or email.
Prevention Strategies: How to Avoid Quid Pro Quo Attacks
In the previous section, we touched on some key lessons to prevent quid pro quo attacks. Let’s explore these a bit more.
Training and awareness
As with all social engineering attacks, awareness is the primary line of defense.
- conduct workshops to educate employees about the nature of quid pro quo attacks, emphasizing the tactics used by attackers who offer services or benefits in exchange for sensitive information;
- teach staff to identify unsolicited offers, especially those that seem too good to be true or come from unfamiliar source
Verification protocols
Don’t trust, verify:
- establish procedures for verifying the identity of individuals requesting sensitive information or access. This can include calling back IT support through the official number.
- enable MFA to add an extra layer of security, ensuring that access requests are legitimate.
Robust security policies
- develop and disseminate comprehensive security policies that outline acceptable behaviors, procedures for handling sensitive information, and protocols for reporting suspicious activities.
- create an easy-to-use system for employees to report quid pro quo attempts or other security incidents.
Other best practices to avoid quid pro quo attacks
- Always be cautious. Nothing is ever totally free. And if something sounds too good to be true, it probably is.
- Never give personal information unless you initiated the exchange. If you need to provide your login credentials to a legitimate IT professional, making sure to change it afterwards.
- Use strong passwords and change your passwords regularly. Review our article on passwords to get into good habits.
The Rise of AI in Quid Pro Quo Attacks
Artificial intelligence (AI) has reshaped how cybercriminals organize their social engineering scams.
Up until very recently, quid pro quo attacks relied on deception through human interaction. But AI now allows fraudsters to automate and refine their methods with alarming precision.
Machine learning models process enormous amounts of information. This enables attackers to craft highly deceptive interactions. Social media posts, leaked databases, public records… AI now enables attackers to generate hyper-personalized communication that appears entirely legitimate.
For example, an AI-powered chatbot can convincingly mimic an IT support agent, offering fake assistance in exchange for confidential credentials.
Beyond text-based manipulation, deepfake technology and synthetic voice software add another layer of deception. Attackers can fabricate audio and video recordings that imitate real individuals, making fraudulent requests seem irrefutably authentic.
As a result, people are far more likely to comply, believing they are interacting with a trusted colleague or supervisor.
The growing use of AI in these scams demands stronger awareness and better security defenses. Companies and individuals must stay ahead of emerging threats by adopting multi-factor authentication, scrutinizing unsolicited requests, and fostering a skeptical approach toward unexpected offers of assistance.
Wrap up on Quid Pro Quo Attacks
A quid pro quo attack is a cyberthreat based on an exchange of goodwill. This makes it more insidious because as humans we think we have to return any service provided in one way or another.
Hopefully, through this article, you have gained a better understanding of what quid pro quo attacks are, and how to protect yourself. Last but not least, use secure services such as an email suite like Mailfence.
Want to learn more? Check out these online courses and studies on the topic of social engineering:
- Understanding Social Engineering Attacks provided by TEEX
- 1 Day Social Engineering and Phishing Mastery Course by CQURE Academy
- 2024 Cost of a Data Breach Report by IBM
- 2024 Data Breach Investigation Report by Verizon
