PHISHING
PHISHING
com
PHISHING
DREW BACKENSTOSS
Generated for #21798 Thomas Gibbons tgibbons273@gmail.com
Copyright © 2017 Scott Andrews Entertainment. All Rights Reserved. This material
may not be reproduced, displayed, modified, or distributed without the express
prior written permission of the copyright holder.
For permission, contact mindofandrews@gmail.com.
Generated for #21798 Thomas Gibbons tgibbons273@gmail.com
Drew Backenstoss
mindofandrews@gmail.com
Generated for #21798 Thomas Gibbons tgibbons273@gmail.com
“I’m happy to crawl inside your heads if you’re willing to allow me.”
The group laughs somewhat hesitantly but with great interest in the offer. I bring
out my phone and pull up my photos while explaining—
“Every few years a group called SplashData releases a list of the ‘TOP 25 MOST
POPULAR PASSWORDS’. The information is collected from millions of stolen
passwords made public through internet security breaches.
I pass the phone around the group so everyone can take a look.
“It’s crazy to think that passwords like ‘123456’ and ‘111111’ are so commonly
used that they made it into the top ten!
Some of them are a bit less obvious. Take for instance ‘qwerty’—ranked at number
fourteen. It seems like a random made-up word until you realize that it’s just the
first six letters found on the top row of every keyboard.
I will say though, it’s nice to see that ‘jesus’ made it onto the list for the first time
that year. He had to knock ‘superman’ down one spot but he finally did it! It gives
me hope that there’s more to the internet than porn and cat videos . . .
I should point out, if you see your password on the list—take that as a sign that it’s
time to update!”
Most everyone in the group laughs—but a few people sheepishly admit to using one
of the passwords on the list.
“There are loads of technical ways to hack into people’s accounts and steal their
identities—but I’d like to show you how I’d do it . . . IF I were ever to succumb to
the ‘dark side’.
In order to protect your privacy I’m not going to target your real passwords—I’ll
just have two of you think of one from the list.”
1
Generated for #21798 Thomas Gibbons tgibbons273@gmail.com
Identifying two people from the group that I’ll use for the demonstration I hand over
my phone to them.
“I’d like both of you to lock one of these passwords into your mind. Bryan you
think of one ranked at an even position and Allie you think of one at an odd
position—that’ll ensure that you won’t think of the same one.”
“From this point on I’m going to refer to this password as ‘YOUR password’.”
The phone is put away and all attention is now on Bryan and Allie.
“I need each of you to really visualize your passwords. See it spelled out in your
minds and think of the last time that you typed it—or something like it—
on your computer.”
We’ll start out with something simple so I can gauge your responses. Can you
think of how many letters are in your password? Please disregard any
numbers or symbols there might be and focus only on the letters.”
He takes a moment to think and then nods. I ask for his hand and hold his left wrist
lightly with my right fingers.
“Keep the number of letters at the forefront of your mind—three, four, five, six,
seven, eight, nine, ten . . .”
On each count I move his hand side to side apparently trying to feel any response to
the numbers.
2
Generated for #21798 Thomas Gibbons tgibbons273@gmail.com
“Don’t tell me which . . . but you’re thinking of eight or nine letters correct?”
Bryan releases the laughter he’s been holding back and acknowledges that he is.
“Let’s take this a step further—without any contact this time. Only in your mind I’d
like you say the first letter of your password over and over again . . . like O, O, O . . .
or whatever the letter is.”
It’s obvious that Bryan is intently concentrating on his assigned task. After a
moment I smile and instruct—
“Now move on to the second letter and repeat that again and again in your mind.”
“This one is a bit more difficult . . . you’re more aware of what I’m looking for and
your poker face has improved.
Please open your mouth just a bit and imagine screaming this letter across the
room.”
“Well this is where I’m reminded that this isn’t a perfect science. I may not be
successful with you . . . unless this second letter is a P or a B . . .”
“Perfect!
Here’s the interesting thing—when you ask someone to think of a letter around the
end of a word most will think of one and then change their mind . . . from that
smile I can see that’s exactly what you’ve done.
What interest me about you specifically though is that I have to determine what
kind of letter you’d think of first and then switch to. You’re clearly an intelligent
person. What do you do for a living?”
3
Generated for #21798 Thomas Gibbons tgibbons273@gmail.com
“As an analytical person I think that if you first thought of a vowel, you’d
switch and think of a consonant because then it’s not just a one in five guess of
your letter—so with that in mind I think there’s an L near the end of your
password yes?”
“Abs4miles.”
“Well done Bryan! That’s such a humble expression of how you see yourself!”
“Now that I’m warmed up I’d like to try something much more difficult with
you.
If someone were able to hack into your computer or phone they’d have a ton of
information available to them—phone numbers, addresses, personal
documents, pictures of treasured memories. It’s a little scary to think about!
Allie, I’m going to try to bypass your password and go straight to the personal
information. Are you up for that?!”
She thinks for a moment but ultimately gives in to her own curiosity and the
pressure from her friends.
“Let’s have you make some free associations with your password to get to a
memory from your childhood.
Go ahead and think of . . . the last letter of your password. Now, if you can,
please think of one of the fifty states that begin with that letter. If you have
some connection to the state then all the better.
Now take, let’s say, the second letter of that state and think of a month in the
year that begins with that letter . . . or maybe a holiday if that’s easier.
4
Generated for #21798 Thomas Gibbons tgibbons273@gmail.com
Don’t say anything more than yes or no, but do you have a specific month or
holiday in mind?”
Allie nods.
“I’d like you to imagine that you’re nine years old and experiencing that specific
time of the year. Think about some of the fun activities that you’d be doing. Think
about the people that you’d be with. Really see yourself there.”
Allie is noticeably sincere in following the instruction. After a few beats I explain—
“I stepped you through that association process because if I just asked you to think
of a holiday most people jump right to Christmas or maybe the Fourth of July—you
know, the big ones. You might be thinking of one of those but regardless that was a
much more random process than simply going with the first thought that popped
into your mind.
Now genuinely I couldn’t know anything about this memory correct? You’ve not
written anything down and I didn’t overhear you talking about this earlier. In fact,
how long has it been since you last thought about this activity . . . this memory?”
After a moment of thought she responds, “It’s probably been three or four years at
least.”
“Up until this point you all can appreciate that I’ve picked up on the information
via a logical process—but if I tell you how I get a sense of your memory it won’t
work.
Do your best to keep a straight face and by no means say anything unless I ask you
a direct question.”
Stepping back I appear to size her up and then, with a smile, I continue—
The weather is actually quite nice—it feels fresh and flowers are in bloom. I
imagine that this memory takes place in the spring. Is that right?”
Allie does her best to hold back her excitement but confirms my assertion is correct.
“As you look around at the faces present in this memory I’m getting a sense for
some names . . .”
5
Generated for #21798 Thomas Gibbons tgibbons273@gmail.com
Somewhat unsure I proceed to say several names as though they are free flowing
into my mind—
“Chris—Jennifer—Michael—Josh—Jessica . . .”
“Oh I see! You’re surrounded by close family members and friends yes?!”
“And I can see that you’re having a great time playing a game . . . of sorts. But
it’s not a typical child’s game like Duck-Duck-Goose or Hide-and-Seek is that
right?”
She eagerly nods feeling as though I’m on the brink of nailing the specific memory
she has in mind.
I signal Allie to come closer and lean towards her ear for a whisper. Although the
rest of the group can’t hear what I’m revealing to her, there is no doubt that Allie is
visibly astonished by my words.
Allie agrees that my description of her childhood memory was spot on.
“It’s been a pleasure to meet you all—thanks for opening up your minds to
me!”
Methodology
The “TOP 25 MOST POPULAR PASSWORDS” list (see the image on the next page)
stored on the phone brings together several principles to create the effect described
above.
Beyond the mechanical aspects of the word list the real power in this piece comes
6
Generated for #21798 Thomas Gibbons tgibbons273@gmail.com
from congruent acting and the application of your favorite ploys to milk the most
out of each revelation.
As was likely apparent from the scripting, I personally draw heavily from the work
of Peter Turner and Jerome Finley to seemingly reveal more details about the
password and childhood memory beyond the basic information gleaned (or forced)
in the routine. Peter’s “Confirmation Principle” as is beautifully employed in his My
Take on a Classic routine and Jerome Finley’s ever insightful touches, especially with
regards to his piece In the Madhouse, are the true inspirations for the second phase
of Phishing. Like Peter’s and Jerome’s routines, I am essentially fabricating the
details of a supposed memory in such a way that the participant accepts them to be
real.
The explanation that follows will break down all elements of the routine to discuss
the role each plays in the overall effect.
Background
The List
The truth is that hidden inside the structure of the list is a series of principles that
7
Generated for #21798 Thomas Gibbons tgibbons273@gmail.com
allow for a very clean and direct revelation of one “freely” thought of password and
one “freely” thought of memory.
I created the graphic to look exactly like a screenshot taken from a website. If you’d
like to use the one I’ve prepared you are welcome to email me at
mindofandrews@gmail.com and I’d be happy to send it over (it’ll also give us a
chance to meet!). Please keep in mind that the image I use is optimized for my
iPhone 7. Alternatively, you could store the list on your notes app (this is what I did
for a long time before creating the custom graphic).
As noted in the performance script above, the two participants are instructed to
think of a password falling either on an even or odd position in the list. The overt
justification is so that they don’t happen to arrive at the same password—but
covertly it effectively pares down each participant’s choice from one in twenty-five
to (about) one in twelve. After explaining the basic methodology used when
performing with two participants I will discuss how I use this same list for just one
person.
NOTE: Due to the fact that a new list is released each year some people may be
familiar with the passwords on the most recent “Top 25”. For that reason I like to
claim that the list on my phone is a few years old. Where possible I used as many of
the REAL passwords (or slight variations thereof) on the 2014 list as I could—so
many of them are genuine (helping to increase its perceived authenticity).
You can reveal any password at an even position through the help of three main
strategies that build on each other—first, the twelve options are pared down to just
eight by overtly drawing attention to four of them in your introductory remarks;
second, through gauging the amount of time the participant takes to count the letters
in the thought of password; and third, through a branching system combined with a
very effective fishing sequence.
As detailed in the PERFORMANCE & SCRIPT section, while introducing the list I
explicitly draw attention to “111111”, “123456”, “qwerty”, and “jesus” – all of
which are at even numbered positions on the list. Referencing them makes sense
within the presentation (and even affords a bit of humor) as well as effectively
ELIMINATING them from being chosen. If you’d like to absolutely ensure that they
8
Generated for #21798 Thomas Gibbons tgibbons273@gmail.com
aren’t thought of you simply need to casually add the line—“To keep things
interesting don’t think of a password that I’ve already mentioned.”
Four of the remaining eight possible passwords contain only three or four letters—
the remaining four passwords contain eight or nine. Simply by gauging the time it
takes the first participant to think of the amount of letters comprising the thought of
password you’ll be able to assess which of the two groupings he or she has in mind.
All credit goes to the brilliant Michael Murray for this principle. He titled it the
“Comparative Uncertainty Principle” (or CUP’s for short) and further applications
for it can be found within Michael’s seminal work A Piece of My Mind (along with
MANY other ploys that are equally as devious for the modern mind reader). It’s
VITAL that you instruct the person to disregard any special characters or numbers
in the password and ONLY focus on the letters.
At this point you already have quite a bit of information and yet to the audience
NOTHING has happened—it’s a great position to be in.
To all watching I apparently sense a subtle response to the number while counting
and holding the participant’s wrist. Only now do I reveal the information gleaned
earlier through gauging the counting time. If you’ve ever wanted to practice contact
mind reading in a “safe” manner—this is a great time to do it. You’ve got a safety net
in place with this routine and you only have to really “get a read” on two numbers.
You’ll notice that the two possibilities within each letter grouping can be further
differentiated by their second letters—B or P.
9
Generated for #21798 Thomas Gibbons tgibbons273@gmail.com
Begin by saying, “Only in your mind I’d like you say the first letter of your password
over and over again . . . like O, O, O . . .” Here you are just throwing out either the
letter O or the letter A. If their password begins with that same letter the participant
WILL react. If the participant doesn’t react you continue by adding, “. . . or whatever
your letter is.” This ruse has been used by a number of performers (most notably
Derren Brown and often referred to as his “Repeat It” ploy) within fishing sequences
because it either leads to an incredibly direct hit or, at worst, it seems as though you
are just explaining what the participant should do—either way you are deceptively
cutting the remaining word options in half.
The next phase in the sequence is identical regardless of the outcome of the
previous step—a positive or neutral response to the thrown out letter merely
directs you to the appropriate letter grouping “O-Long/A-Long” or “O-Short/A-
Short”.
You now request that the participant think of the second letter in his or her
password. After a moment act as though you’re struggling to ascertain this letter
and say, “This one is a bit more difficult . . . you’re more aware of what I’m looking for
and your poker face has improved.” Then add, “Please open your mouth just a bit and
imagine screaming this letter across the room.”
After apparently studying the participant’s lips carefully for a moment continue,
“Well this is where I’m reminded that this isn’t a perfect science. I may not be
successful today . . . unless this second letter is a P or a B . . .” I’ll often subtly gesture
towards my lips and emphasize the P/B lip formation (I just act as though I’m saying
both of the letters and my mouth is identical miming both sounds). This reinforces
the fact that I’m looking for nonverbal clues that will shed light on the participant’s
thoughts.
The goal here is to provide the participants with a process that they can interpret as
the “mind reading”.
If the participant doesn’t specify which letter it is at this point—simply ask! This
direct question comes after two or three INCREDIBLY clean revelations of the
participant’s thoughts and it’ll fly right under the radar.
Knowing the second letter gives you all the information that you need to reveal the
specific password the first participant is focused on.
10
Generated for #21798 Thomas Gibbons tgibbons273@gmail.com
A Streamlined Explanation
Below I’ve detailed the process in a streamlined manner so that you can see how the
elements work together.
Step One: “Please think of how many letters your password contains.”
Step Three: “Think of the first letter of your password and repeat it over and over in
your mind . . . like O, O, O…”
11
Generated for #21798 Thomas Gibbons tgibbons273@gmail.com
The great thing about this phase is that it’s extremely simple (methodology wise)
when compared with the process just described. Structurally, I also like that it
follows the branching system because once you’ve “warmed up” on an indifferent,
random thought of password you can push ahead with some inexplicably direct
mind reading OF A CHILDHOOD MEMORY. The differing methods used in both
phases also effectively cancel each other out—you are fishing for information in the
first and forcing information in the second.
When you instruct the second participant to think of one of the fifty states in the U.S.
that begins with the LAST LETTER of his or her password they can only think of
Delaware, Pennsylvania, Tennessee, Texas, Georgia, New York, New Mexico, Nevada,
Nebraska, New Hampshire, North Carolina, and North Dakota because the passwords
at the odd positions ONLY end in one of the following letters: D, P, T, G or N.
Notice that the SECOND LETTER of each of the possible states is either E or O—and
this, coupled with the fact that October is the only month that begins with O and
Easter is the only holiday that begins with E, pushes the participant in the proper
direction.
One more instruction successfully forces this to happen. Simply say, “Now take, let’s
say, the second letter of that state and think of a month in the year that begins with
12
Generated for #21798 Thomas Gibbons tgibbons273@gmail.com
that letter.” Pause for a brief moment to give the participant time to think. If they
make the association quickly they are thinking of O (for October) and finish the
statement by saying, “and finally think about a holiday that falls in the month—
whatever you looked forward to most as a child.” If you sense they are struggling to
associate their letter with a month then they are thinking of E and you then finish
the instruction with, “. . . or a holiday if that’s easier.” Odds are that the participant
will ultimately be led to think of Easter because out of the available twelve states
they might have in mind only two have O as their second letter.
The key to “selling” the above procedure is to make it appear as though you are
creating the process on the spot in an effort to truly randomize the outcome. It isn’t
nearly as convincing if it feels like the associative journey is premeditated.
At this point it’s important to choose your words carefully so as to avoid the
participant thinking of a PRECISE memory from his or her childhood. I say, “I’d like
you to imagine that you’re nine years old and experiencing that specific time of the
year. Think about some of the fun activities that you’d be doing. Think about the
people that you’d be with. Really see yourself there.” I owe a special word of thanks to
Atlas Brookings for helping me refine this bit of scripting.
It’s only after these general activities come to the participant’s mind that I subtly
switch my words to convey the idea that he or she is focused on a specific
memory—“Genuinely I couldn’t know anything about this memory correct? You’ve not
written anything down and I didn’t overhear you talking about this earlier. In fact,
how long has it been since you last thought about this activity . . . this memory?”
13
Generated for #21798 Thomas Gibbons tgibbons273@gmail.com
universal experience—even more than that, Jerome’s method allows you to get to a
powerhouse reveal in a most economical and elegant manner.
In the performance description I detailed the way in which I’ll often conclude the
piece—a touch, once more inspired, by Peter Turner. His “Bob Principle” creates a
great enigmatic moment where I share a private whisper with the participant. Done
correctly, the participant is visibly touched by the whisper and the audience at large
is left to wonder what I said. I’m not at liberty to disclose what is whispered during
this moment but I encourage you to search out the principle (that has MANY uses
beyond this one) either through Peter’s Devil in Disguise or Bigger Fish 2.
Alternatively—and the way I’ll conclude depending on the audience and situation—
you can just reach a point where you appear satisfied with all of the details that you
intuited about the memory and ask the participant outright what they all mean OR
“take a guess” that it revolves around an Easter-Egg hunt or Trick-or-Treating.
It’s possible to use the same list and sequence of strategies when performing for just
one person—there’s just an added step.
The participant is welcome to freely choose any one of the passwords from the list
(still be sure to exclude the four passwords mentioned in the script). Acting as
though you first need to warm up and build a bit a rapport between you and the
participant say, “Before really diving in, I’d like to start small with something
inconsequential so that I can gauge your responses.” Ask for the person to focus on
whether the position that the password occupied in the list was odd or even. Hold
the person lightly by the wrist and move it back and forth while saying, “This side is
odd and this is even . . . just focus on whether it’s odd or even.”
Use genuine contact reading, if it’s a skill you possess, to correctly ascertain if the
person’s number is even or odd and proceed with the corresponding original
methodology.
You can also just assert that the number is even and cover a miss, much like step
three of the fishing sequence, by saying, “Hmm…I might have to take a different tactic
with you. Let’s change course and have you make some free associations with your
password to get to a memory from your childhood.” With that, proceed with the
“Chunneling” process to get to an Easter memory. By ALWAYS claiming that the
number is EVEN the miss justifies using “a different tactic.”
14
Generated for #21798 Thomas Gibbons tgibbons273@gmail.com
This additional feature will allow you to identify any thought of password occupying
the odd numbered positions on the list—simply by knowing the first letter of the
word. Each odd numbered password begins with a different letter of the alphabet as
follows (not all letters are used):
I only utilize this feature when and if the second participant request that I divine the
password he or she first thought of.
Many gimmicked book tests employ this principle and there are several ways to
mask the necessary fishing for the first letter ranging from a swami to double
writing strategies. My preferred method is to invite someone else in the group to
intuit the first letter. Then instruct both participants to say aloud their letters on the
count of three. If the person is correct capitalize on the moment and congratulate
the individual. It’s unlikely that a second guess will be accurate and you simply need
to say something along the lines of, “It takes some time to develop your intuition for
this sort of thing. I was getting the impression of an [insert the correct second letter].”
You’d make a similar statement if the first guess was incorrect—either way, you’ve
successfully learned the first letter and can proceed to reveal the word as you
desire.
Variations
Tossing Out the Phish
By simply writing out each of the passwords from the “Top 25” on separate index
cards or blank (on both sides) playing card stock you can present it to a larger
audience in much the same way as you would a traditional tossed out deck. Used in
this way, Phishing boasts a number of advantages over the typical tossed out deck
methodology—the card stack is un-gimmicked, you can freely show that the
passwords are all genuinely different, and there is no dual reality as per the norm
when using the revelation sequence from “David Hoy’s Tossed-out Deck Principle.”
You still need to control who looks at which bank of words (even v. odd) and here
are a few ideas for doing just that:
15
Generated for #21798 Thomas Gibbons tgibbons273@gmail.com
Use markers of differing colors for each of the password banks. For those
familiar with Sean Water’s piece Random Sample from his mini eBook So
Random you can use Sean’s wonderful premise and justify the two colors as
a way to distinguish the passwords attributed to men and those common to
women. This would also provide some inherent by-play with the audience
when the password choices are made.
Keep the first bank of passwords congregated together on the top of the card
stack and the second bank on the bottom. After introducing the stack and
displaying a number of the passwords you can give the cards a casual
overhand shuffle while maintaining the two banks in their respective
positions. You can then separate the two portions via a mark, short card,
crimp, or any other means as you hand the halves to two people in the
audience and request that they think of a password from their respective
piles.
With any of the above ideas you could involve a third participant and use the “First
Letter Principle” to garnish a third revelation. The structure of the piece could then
be—reveal the first password through the fishing and branching anagram
strategies; reveal the second through the “First Letter Principle”; and then offer to,
“take things a step further,” and use the “Chunneling” process to reveal the childhood
memory.
If you feel like only performing the memory reveal in Phishing and don’t mind taking
a (slight) risk you can use Colin McLeod’s Direct Flight from his inspiring book
DIVINE to achieve the desired result. Those familiar with Colin’s effect will clearly
see how Easter can be substituted for Colin’s force word.
Pre-season Phishing
No need to go into great detail with this variation except to say that because the
selection process is so fair there is no real need to hide it from others. Your scripting
during the show would of course gloss over the pre-show selection but can also
emphasize that the participants have truly never written down their passwords—
the passwords GENUINELY only exist in their minds.
16
Generated for #21798 Thomas Gibbons tgibbons273@gmail.com
The only other subtlety worth pointing out occurs once the participants have each
chosen a password to lock in their minds. I then say—“From this point on I’m going
to refer to this password as ‘YOUR password’.” During the show, when you ask the
two pre-showed participant’s to think of THEIR PASSWORDS and confirm that they
haven’t told anyone or written them down the rest of the audience will believe you
are revealing GENUINE passwords. You’ll see that I utilize this nuance even in casual
settings when the selection process occurs in front of everyone (as described in the
PERFORMANCE & SCRIPT section). Re-framing the password from the list as “YOUR
password” has the potential to cause people to misremember it as a real password
when they think back on the performance.
THE SPECIFIC PASSWORDS THAT COMPRISE THE LIST ARE FAR LESS IMPORTANT
THAN THE OVERALL STRATEGIES TO REVEAL THE THOUGHT OF INFORMATION
By that I mean that a variety of passwords will work within the framework that lies
at the heart of this piece. My “Top 25” list may not work for everyone but that
shouldn’t deter you—simply construct your own based on the combination of
principles that I’ve outlined.
For all non-US but still English speaking performers out there, the easiest way to
alter my original list to work in your country is to adjust all of the passwords at ODD
positions so that they end in either an O or an E. Thus you are simply by-passing the
association with a state and going directly to the month or holiday.
The added advantage of making your own list is that the memorization required for
the piece will come naturally as you spend time finding/creating suitable
passwords.
As they say—
“Give a man a ‘phish’, and he’ll perform only one way. Teach a man to ‘phish’,
and he’ll perform in his own UNIQUE way!”
17
Generated for #21798 Thomas Gibbons tgibbons273@gmail.com
Inspirations
“A Man of Many Names” Psychological Subtleties 2 by Banachek (contribution by
Michael Sibbernsen)
18