What is pretexting?
Pretexting is social engineering built on a made-up scenario, the pretext, that gives an attacker a believable reason to ask for information or access. The attacker plays a role, such as an auditor, a new hire, a vendor or IT support.
How it works
A good pretext fits the target’s world: a payroll provider confirming bank details, an auditor needing a report, a help desk technician fixing a sign-in problem. Attackers often build it over several contacts before asking for anything.
Pretexting underpins business email compromise, help desk attacks and many vishing calls.
Why it matters
Pretexts work because they sound routine. Clear verification steps for sensitive requests protect people from having to judge every story.
