Pretexting

Description

The strength of pretexting is context. If the attacker knows an employee's name, the department, a supplier, a project or an internal process, the conversation no longer sounds like an attack. It sounds like work. The victim does not give things away out of carelessness but because the story fits their expectations.

Unlike mass phishing, pretexting requires thorough preparation. The attacker uses publicly available information, LinkedIn, the company website, job adverts, old emails and the habits of the organization. The goal can be a password, a document, access to a room, or a confirmation that opens the next step.

Examples

• The attacker presents themselves as a new member of the IT team and asks the user to confirm a password or an MFA code because accounts are supposedly being migrated.
• A call from a supposed auditor asks for urgent access to financial documents, citing the name of a real manager.
• Someone presents themselves as a courier or a service engineer and is let into the business premises because the story sounds routine.

Notes

• A good story is not proof of identity. The more detail somebody knows, the less it means they are legitimate and the more it means they prepared better.
• Identity is verified through an independent channel, not through the number, link or contact the attacker has just given.