top of page
  • Writer's pictureAndy Murphy

The Criminal Playbook: How Criminals Attack

Understanding The Phases of an Attack

Today I want to share with you the criminal’s playbook. No, this is not a three-ring binder that’s handed out at criminal camp.

It’s a linear process that humans follow when they want to attack. For our purposes, we’ll talk about this as it pertains to crime. There is a definite start and finish to the process. And if we know what this process is, then we can better protect ourselves from it.

In doing research for this show, I found that our friend Chris Pendas at Staying Safe has done great work on the phases of an attack. I’ll use his model to explain the process.

What many people don’t give enough credit to is that criminals have the advantage. Read that again:

Criminals have the advantage.

Criminals are ahead of the game because they choose the target, observe it, and plan their attack before anyone knows what’s going on. They have momentum and usually, they blindside their targets, catching them off guard because that gives the attacker the best advantage for success.

The Criminal’s Paybook

The phases of an attack, or what I’m calling the criminal playbook, can be broken down into three main parts:

  1. Pre-Attack

  2. Attack

  3. Post-attack

This is very much a beginning, middle, and end process. The pre-attack phase is made up of three sub-phases: target selection, observation, and planning and training.

The Pre-Attack Phase

The start of the entire process is target selection. The target can be a person, website, or company. You get the idea.

Criminals will generally find a target that they feel they can overpower. Small street criminals are not going to attack four uniformed police officers. They know that’s not going to work. But they can go after a lone person who seems unaware of their surroundings.

Once a target is picked, it’s time for observation. Observation can be done in person, online, or any other creative way you can imagine. They want to know more about the target to better their chances of success.

Criminals what to stack their advantages against you so there’s no way they’ll get caught or hurt. Once they have what they think they need they move to the next phase.

The last sub-phase is planning and training. Here is where the criminal will formulate their plan of attack with what they know of their target and their ultimate goal. While it may not seem that some criminals don’t plan, they do. (And it might not be a good plan, either.)

It may only take a few seconds and it may not be a good plan, but there is a plan. And the planning and training stage can vary greatly depending on what the criminal wants to do.

A great example of this is one of my favorite heist movies, Ocean’s 11. In that movie, an entire team of people has to train using a full-scale mock-up of a casino vault. They go through all of the variables until they are a well-oiled machine. This way when Ocean’s team attacks, they are prepared and have the advantage.

The Attack Phase

Now we move on to the attack phase. While you may think that attacks are only violent, that’s not the case. In his writing, Pendas points out that attacks can be done in two ways: charm and blitz.

A charm attack goes as you think. Someone is going to use their social engineering skills to deceive you into giving up something of value. Examples of this are targeted phishing emails, phone scams, and of course face-to-face manipulation. Generally, these attacks aim to avoid violence.

A blitz attack falls into two categories: mental and physical. A physical blitz attack makes use of fast, overwhelming force. Moving quickly and hitting hard has been used by humans since the dawn of time. It’s efficient and has a lower risk to the attacker. These types of attacks can be devastating depending on the aim of the criminal, including sexual assault.

A mental blitz attack can be intimidation or the threat of violence to get what they want. A good example of this is the criminal who supposedly has a gun in their pocket. They don’t pull it out to draw attention to themselves or aim it at their target but use it as a threat for compliance.

The Post-Attack Phase

The final part is the post-attack phase. This phase has two parts, escape, and exploitation.

Escape is obvious to us. For the successful mugger, it’s running down an alley and disappearing into the crowd. But if the criminal doesn’t achieve their goal in their attack and they fail, then escape is still the next option, it’s just not as rewarding for them.

Exploitation can be several things. Pendas uses a great example which is the instance of a kidnapping, the ransom is the continued exploitation of the victim.

Another form of exploitation can be a sexual predator who lords their attack over a person for years threatening them with violence or manipulating them even further. Generally, anything a criminal can do to the victim after the attack is considered exploitation, even testimony in a trial.

So now that we have the criminal’s playbook, let’s talk about how to beat it.

For those of you who have been with me for a while, you are aware of the left of bang mindset. As a quick refresher on a linear timeline, a bang is an attack. It can be a holdup, an IED, a hack, or an outright assault. Everything that happens before bang is left of bang. And everything that happens after is right of bang. Where we strive to be is left of bang because we want to see trouble before it starts and respond accordingly.

Now I want to combine this left-of-bang mindset with our criminal playbook. The pre-attack stage is left of bang. The attack is bang. The post-attack is right of bang.

So if we want to keep ourselves safe from an attack, we need to look for those pre-attack indicators like target selection, observation, and planning. Because if we’re not aware then we won’t know something is wrong until something goes bang.

Outplaying the Criminal

The criminal playbook starts in the pre-attack phase with target selection. You can’t help it if a criminal targets you. What you can do is get yourself deselected as fast as possible.

This could be as simple as paying attention to your surroundings. A criminal may see you too alert to get the drop on you, so they move on to someone they can get to. That’s shutting them down before they even get started.

For the observation phase, we can remember that generally, no one cares what we do. Let’s be honest, people aren’t watching you shop at the grocery store. People are lazy and if you’re not important to them, they’ll ignore you.

So if you do see someone watching you at the grocery store, know this is unusual behavior. And the person observing needs to be treated like a potential threat. When you’re being observed, acknowledge it. Here eye contact can indicate to an observer that you see them and that their advantage has been taken away. That can get you deselected as a target real quick.

To stop the planning stage, let’s go back to our conversation with Greg and Brian of Arcadia Cognerati about preventing school shootings.

They told us that people will demonstrate their intent and often school shooter write out their plan. They will make a list of names they want to harm. Some will actually draw maps of how they want to move through their school to carry out their attack. So if you, a parent or teacher, see this type of behavior, it’s time to intervene. Because the next step is the attack. The next step is bang.

You can see the criminal playbook in action. You can act to keep yourself from danger. We simply need to be aware and know the signs. After all, it’s part of our job as protector parents.


Andy Murphy

Andy Murphy founded The Secure Dad in 2016 with the aspiration to help families live safer, happier lives. What started as a personal blog about family safety has turned into an award-winning podcast, an Amazon best-selling book, and online courses. He focuses his efforts in the areas of home security, situational awareness, and online safety.


Andy is a husband and father. His interests include coaching youth basketball, hiking, and trying to figure out his 3D printer.

Get Updates from Andy
bottom of page