Overview
Pretexting is social engineering built on a fabricated but believable story — a pretext — that gives the attacker a plausible reason to request information or action. Where phishing is often a mass lure, pretexting is a crafted scenario, frequently used in targeted attacks.
Learning objectives
- Define pretexting and how it differs from generic phishing.
- Identify the elements of a convincing pretext.
- Recognize and resist pretexting attempts.
Core concept
A pretext is an invented scenario and identity the attacker adopts to earn trust and lower the target's guard. Instead of a suspicious link, the attacker offers a reason to comply: "I'm from IT and need to confirm your login to fix a sync issue," or "I'm a new supplier's accounts manager updating our payment details." A good pretext includes a believable role, a plausible reason, and often some real details (a manager's name, a project) gathered from research or public sources.
How it works
Pretexting relies on trust and social norms: people want to be helpful, defer to authority, and avoid confrontation. The attacker builds rapport, supplies just enough true detail to seem legitimate, and makes the request feel routine. It is common over the phone (vishing) and in person, and it frequently precedes a technical attack — gathering the information needed for a later phishing email or account takeover.
Practical example
An attacker calls the help desk claiming to be an employee locked out before an urgent meeting, citing the employee's real name and department (found on a public profile). The friendly, pressured story persuades the agent to reset the password without proper identity verification — handing the attacker the account. The defense is a strict identity-verification procedure that the pretext cannot talk its way around.
Cybersecurity relevance
Pretexting powers business email compromise (BEC), fraudulent wire transfers, and help-desk attacks. It highlights why process (verification procedures) and culture ("it's okay to verify, even with the 'CEO'") are as important as technology.
Common mistakes
- Assuming a caller is who they claim because they know a few real details.
- Bypassing verification procedures under social pressure or perceived authority.
- Sharing information over the phone that would never be sent by email.
Key takeaways
- Pretexting uses a fabricated, believable scenario and identity to gain trust and extract information or action.
- It leans on helpfulness, authority, and social pressure, often before a technical attack.
- Strict, consistently applied verification procedures are the key defense.
Check your understanding
- How does pretexting differ from a mass phishing email?
- Why do identity-verification procedures need to apply even to callers claiming to be senior staff?