What is pretexting?

What is pretexting?

Pretexting is building a false but believable scenario, the pretext, to persuade someone to hand over information or take an action. The attacker picks a role the victim has a reason to trust and a reason for the request: a help desk technician fixing a mailbox problem, an auditor who needs a report, a vendor updating bank details, a new hire who can't log in, a fire inspector who needs to see the server room. The pretext explains why an unusual request is normal, and that is what gets it past the victim's caution.

Pretexting is closely tied to impersonation. Impersonation is the false identity; the pretext is the story that makes that identity's request make sense. Most vishing calls, business email compromise messages and in-person intrusions depend on one.

How a pretext is built

1. Research: open-source intelligence such as professional networking profiles, the company website, press releases and out-of-office replies supplies real names, roles, vendors, projects and jargon.
2. Role: the attacker chooses someone who would plausibly need the information or access, and whom the target won't want to refuse.
3. Reason and pressure: a deadline, a problem only the victim can solve, or an executive waiting on the result.
4. Props: a spoofed caller ID, a look-alike email domain, a letter on copied letterhead, or, in person, a high-visibility vest, a clipboard or a lanyard.

Small, checkable-sounding details carry the story. A caller who names your manager, mentions last week's system migration and uses the internal name for the VPN sounds like a colleague, even when every detail was public or guessed.

Example: the mailbox migration call

An employee gets a call from someone who says he works on the service desk. He explains that last night's mailbox migration failed for a handful of accounts, including hers, and that her email will stop working at 5 p.m. unless he runs it again. He needs her to read back the code that is about to arrive on her phone. The code is a real MFA code, sent because the caller already has her password and is signing in. The pretext, a routine IT problem with a deadline, is what made reading out the code feel like helping rather than a risk.

Defending against pretexting

• Verify through a channel the requester doesn't control: hang up and call the help desk, vendor or colleague at a number from the directory or the vendor file.
• Give the help desk a written identity verification procedure for password and MFA resets, such as a callback to the number on file and manager confirmation, and don't rely on facts like employee ID or start date that are easy to find.
• Require a second approver and a callback for any change to payment details.
• Teach staff that no legitimate service asks them to read back a code it just sent, and give them explicit permission to challenge and delay anyone, including a senior executive.
• Limit what reception and staff share with unverified callers, and escort visitors whose work order can't be confirmed.

Pretexting and the law

Some forms of pretexting are illegal in the United States. The Gramm-Leach-Bliley Act prohibits using false pretenses to obtain customers' financial information from financial institutions. In 2006 it emerged that investigators working for Hewlett-Packard had used pretexting to obtain the phone records of board members and journalists, and late that year Congress passed the Telephone Records and Privacy Protection Act of 2006, which made obtaining phone records by pretexting a federal crime.

Pretexting vs. related terms

Phishing, smishing and vishing name the channel: email, text or phone. Impersonation names the false identity, and a deepfake is impersonation with synthetic voice or video. Pretexting names the invented scenario that justifies the request, and it can travel through any of those channels. If a question asks how the attacker reached the victim, answer with the channel; if it asks what made the request believable, the cover story is the pretext.

Pretexting on the CompTIA Security+ exam

SY0-801 no longer lists pretexting as a separate item; the pretext now sits inside social engineering: objective 2.5 covers impersonation and related social engineering attacks, and objective 2.3 lists impersonation among human-based threat vectors. A caller posing as IT support during a "migration", a visitor in a vest claiming a fire inspection, or an email from a "vendor" whose bank changed after an audit all describe a pretext. Expect the best answer to be a verification procedure, such as a callback to a known number, rather than a technical control. Distractors include phishing and vishing, which name the delivery channel, and tailgating, which is physical entry behind an authorized person.