Don't: Put on an act that's too perfect

Somewhere between truly honest behavior and the artifice of a ruse, people may begin to intuit that something isn't right.

Academics who study human perception have a name for the point at which the mind begins to pay more attention to, for example, the slightly unnatural motion in a computer-generated animation than to the rich, lifelike detail it presents: They call it the Uncanny Valley.

Social engineering experts also refer to the Uncanny Valley -- it's the moment in a social engineering attempt when everything looks and works just a bit too perfectly and therefore arouses the target's suspicion.

The solution, of course, is simple: Be imperfect. Don't be too polished or quick to answer questions as you perform your social engineering test. Remember, you're trying to convince your target that you're just another working Joe or Jane.

Don't: Panic if you think the jig is up

If you start to get the feeling that you've aroused suspicions, stay calm. It's natural for people to lapse into leeriness from time to time when dealing with people they don't know particularly well. And besides, you have a leg up on the real bad guys, since the only bad consequences for you will be a failed test.

The most important thing to remember when you feel your blood rising is that fleeing from a target works only in the opening sequence of a James Bond movie. In real life, a look of panic or a sudden departure almost always raises a red flag and should be avoided at all costs.

Rest assured that there are many ways to get out of a situation quickly without giving yourself away. It could be as simple as making up a plausible excuse to get off the phone or to just calmly walk away from an irksome employee. Subdue the natural tendency to panic, and easy exits will present themselves clearly. Then you can wait a while, come back, and test from another angle.

Don't: Let the other person think about their actions too much

Interspersing requests for sensitive information with casual conversation can distract the target and help prevent them from catching on to what you are trying to achieve -- especially when they are performing an essential task at your request as part of your social engineering test.

"You're trying to desensitize the person to their actions," Winkler says. "Change the way the person thinks by reframing the action."

For example, if you're trying to get the target to copy some data for you, you could explain to the target that they aren't stealing anything, they're just making a copy of it, and that the data will still be there when the company needs it.

"One of my strategies is to bore people to death over the phone," Winkler says, "so they give me something quickly, just to get off the phone with me."