What is pretexting? How made-up stories are used to steal access and information

Category hub: Social engineering and human risk

In one sentence: Pretexting is when someone invents a believable story and false identity, such as a new starter or IT engineer, to get you to hand over information or access.

What it is

A pretext is the cover story. Pretexting is building and using one. The attacker plays a character in a plausible situation, then makes a request that fits.

CISA describes it plainly. An attacker may seem unassuming and respectable, possibly claiming to be a new employee, repair person or researcher, and may even offer credentials to support the claim. In the UK it is also called blagging. It is less a separate attack than the set-up for others, such as phone fraud, fake help desk calls and business email compromise.

How it works

Research. The attacker collects names, job titles and suppliers from LinkedIn, your website and earlier breaches.
Character and situation. They pick a role that fits, such as a contractor with a booked visit or a colleague locked out of an account.
Contact. They call, email, message or turn up in person.
Small asks first. CISA notes that by asking questions the attacker may piece together enough to infiltrate a network. If one person cannot help, they contact another and quote the first to seem credible.
The real ask. A password reset, a code, a held door, a payment or a remote access session.

Who it affects and how badly

Sole trader to 10 staff. Few rules mean one convincing call can get a password or payment out of you.
10 to 250 staff. Reception, accounts and the help desk are the usual targets. Accountancy and legal practices hold client data, and recruiters give out candidate details by phone.
250 plus and regulated firms. Telecoms, MSPs, insurers, fintechs and healthcare providers face fraudulent account changes and support requests, and may have to report any resulting breach.

Worst case: a false identity at the help desk leads to full account takeover.

Real examples

Scattered Spider. The FBI and CISA describe this criminal group as targeting large companies and their contracted IT help desks, and as experts in social engineering using phishing, push bombing and SIM swap attacks to obtain credentials. The advisory lists protective steps, including phishing-resistant MFA.
CISA’s own guidance describes the repair person and new employee pretexts, and tells staff to verify identity with the organisation and share nothing unless sure of a person’s authority.

How to detect it

Unexpected callers or visitors who know some internal names but ask about others.
Requests that skip the normal process, with an excuse why.
Help desk calls for password or MFA resets that cannot be verified.
In Microsoft 365 or Entra ID, an MFA method change or password reset followed by a sign-in from a new place.

How to fix or prevent it

Write a verification step for every sensitive request: call back on a known number, or use a second channel.
Never accept date of birth or employee number alone as proof of identity.
Give the help desk a script and the authority to say no.
Require ID checks, escorts and sign-in for visitors and contractors.
Use phishing-resistant MFA for admin and finance accounts.
Log every password and MFA reset and review them weekly.
Run phone and email simulations, not only phishing tests.
Make it safe to refuse a request and report it.

Related terms

FAQ

Is pretexting the same as phishing?
No. Phishing is usually a message. Pretexting is the invented story and identity, which can be used in a call, email or visit.

What does CISA say about pretexting?
Attackers may claim to be a new employee, repair person or researcher, and may offer credentials. Staff should verify identity directly.

What is blagging?
It is the UK name for pretexting.

Sources

How Wolfcore helps

Phishy runs realistic phishing simulations against your own staff and shows you who clicked, so you can train the people attackers target. See Phishy phishing simulation.