I haven't watched it yet, but most defcon social engineering talks take advantage of this innate thing in human nature that just assumes you're authentic. Probably because it's infinitesimally rare that someone is trying to run a con. Can be quite sobering, but at the same time, it's nice to know most people try to help others (even at the haste of security).