Pretexting is a social engineering technique in which an attacker invents a believable scenario – a pretext – and a false identity to persuade a victim to share information, grant access or transfer money.
How pretexting works
Unlike mass phishing, pretexting relies on a story tailored to the target. The attacker researches the organisation and its people, then plays a role that justifies an unusual request:
- an employee locked out of their account who calls the IT help desk to reset a password or MFA device;
- an auditor, lawyer or police officer asking for confidential records;
- a supplier requesting a change of bank details, a common step in business email compromise;
- a bank or telecom representative “verifying” a customer’s identity.
Pretexting is often combined with phone calls (vishing), email and messengers, and increasingly with voice cloning. The term is a core part of social engineering, because almost every con needs a pretext.
Why pretexting matters
A well-prepared pretext bypasses technical defences entirely. In 2006 Hewlett-Packard was at the centre of a scandal after investigators it hired used pretexting to obtain the phone records of board members and journalists; the case led to the US Telephone Records and Privacy Protection Act. In 2023 attackers gained access to MGM Resorts by calling the IT help desk while posing as an employee, which led to a major ransomware incident. Pretexting also feeds identity theft, as personal details obtained this way open further accounts.
How to protect against pretexting
- Verify requests through an independent, known channel – call back on a number from your own records.
- Enforce strict identity checks at help desks before password or MFA resets.
- Require dual approval for payments and changes to bank details.
- Train staff to recognise urgency, authority and secrecy as warning signs.
