Pretexting
Pretexting is obtaining information or access under false pretenses, usually by posing as someone with a legitimate reason to ask. The attacker builds a believable story and a role, such as a colleague, supplier or account holder, to make the target comply.
Current as of · Editorial policy
How it works
The US Federal Trade Commission explained the term in a 1998 statement to Congress. It said pretexting is a term coined by the private investigation industry and refers to the practice of obtaining personal information under false pretenses. Its example is an investigator who obtains a bank balance by posing as the account holder.
In security work, pretexting is a form of social engineering. NIST's glossary describes social engineering as an attempt to trick someone into revealing information, such as a password, that can be used to attack systems or networks. CISA adds that an attacker may claim to be a new employee, a repair person or a researcher, and may even offer credentials to support that identity.
A pretext has two parts: a role the attacker plays, and a plausible situation in which that role needs something. The request is small and reasonable inside the story.
How it shows up around executives
Pretexting often targets the people around an executive. A caller who knows the executive's name, assistant, travel plans and recent projects can sound like an insider. The details come from public sources and from exposed data. Breach records can supply a personal phone number, an email address or an old employer, which makes a story hold together.
Pretexting can also be the first step in other attacks. It can unlock a password reset at a help desk, a SIM swap at a carrier, a payment in CEO fraud, or the personal details used in doxxing. CEO fraud and BEC shows which fields make the story convincing.
Reducing the risk
CISA advises being suspicious of unsolicited calls, visits or emails from people asking about employees or other internal information, verifying a person's identity directly with the company they claim to represent, not using contact details supplied with the request, and not revealing personal or financial information by email. Give help desks and assistants a script that checks identity through a second channel and cannot be bypassed by seniority. Reduce the public detail that makes stories believable. CEM shows which executives' email addresses and phone numbers already appear in breach corpora and leak databases, so you know which details a pretext can use.
How it differs from related terms
Pretexting is the story. Phishing is one delivery method for a story, and whaling is a targeted attack aimed at senior people. Business email compromise is a fraud type that often relies on a pretext. A pretext can also be spoken, in person or by text message, with no email at all.
Frequently asked questions
Is pretexting the same as phishing?
No. Pretexting is building a false scenario to obtain information or action. Phishing is a delivery method, often by email, and may or may not use a detailed pretext.
Where does the term come from?
The FTC said in 1998 that the private investigation industry coined it for obtaining personal information under false pretenses.
Sources
- Prepared Statement of the Federal Trade Commission on "Obtaining Confidential Financial Information by Pretexting" (July 28, 1998), Federal Trade Commission, accessed
- Social engineering (NIST CSRC Glossary), NIST Computer Security Resource Center, accessed
- Avoiding Social Engineering and Phishing Attacks, CISA, accessed
Related terms
See your leadership's exposure
CEM finds your executives from your company name, checks them against breach corpora and leak databases, and scores each person from 0 to 100.