You find a USB drive in the office parking lot, labeled “Payroll 2026.” Curiosity says plug it in to find the owner. That curiosity is exactly what the attacker counted on. Baiting is the art of dangling something tempting — a found drive, a free download, a too-good offer — to lure you into compromising your own security. Our GetMyPassword team explains what baiting is and how to resist it.
What baiting is
Baiting is a social-engineering technique that uses a tempting lure to get you to take an action that harms your security. The classic example is a malware-loaded USB drive left where someone will find it and plug it in out of curiosity. Online, baiting takes the form of “free” downloads, pirated movies or software, prize offers, or enticing attachments that actually carry malware or lead to credential-stealing pages. The common thread is desire: instead of scaring you, baiting offers you something you want, so you lower your guard and do the attacker’s work for them.
Common forms of baiting
- A found USB drive or memory card with an intriguing label.
- “Free” movies, music, or paid software from unofficial sites.
- A prize or gift-card offer that requires a download or install.
- An attachment promising something you want — a bonus, a leaked file, a coupon.
- A “free” device or accessory in exchange for plugging it in or installing an app.
Why temptation works
Most security advice trains you to spot threats and pressure, but baiting comes dressed as opportunity, which slips past those defenses. The promise of something free or exclusive creates a small thrill that crowds out caution, and the action required feels harmless — just plug in, just download, just open. But a single malicious file or device can install malware, capture your keystrokes, or open a path into your accounts. The rule of thumb is simple: if you did not seek it out, treat unexpected “free” things as suspect, especially when they ask you to run, install, or connect something.
Baiting does not frighten you — it tempts you. A “free” download or a found drive is a hook wearing a gift bow, and plugging it in is doing the attacker’s job for them.
How to protect yourself
Never plug in a USB drive or device you found or were unexpectedly given, and download software only from official sources. Be wary of “free” media and prize offers that require an install, and keep your devices updated with reputable security software. Use a standard, non-admin account for daily use so malware has less power. And protect every account with two-factor authentication and a unique password from our password generator, so that even if a bait succeeds, the damage is contained.
Frequently asked questions
What is baiting in cybersecurity?
Baiting is a social-engineering technique that uses a tempting lure — a found USB drive, a free download, a prize offer — to get you to take an action that installs malware or steals your credentials. It exploits curiosity and desire rather than fear.
Is plugging in a found USB drive really dangerous?
Yes. A found drive can carry malware that runs when connected, installing spyware or opening access to your system. Never plug in a USB drive or device you found or were unexpectedly handed.
How do I protect myself from baiting?
Do not connect found devices, download only from official sources, be wary of “free” media or prizes that require an install, keep security software updated, and use two-factor authentication with unique passwords so a successful bait does limited damage.