What is Pretexting? How to Avoid Being Victimized

Pretexting is a type of social engineering attack that is often used to gain access to confidential information. In a pretexting attack, the attacker creates a scenario in which they can extract personal data from the victim. For example, the attacker might pose as an employee of your company and ask you to provide your login credentials. Or they might call you and pretend to be from your bank, asking for sensitive account information.

If you are not aware of these types of attacks, you could easily fall victim. In this blog post, we will discuss what pretexting is and how to protect yourself from being victimized by it.

What is pretexting?

Pretexting is a type of deception where an individual creates a false pretext, or pretense, in order to obtain personal information from another person. The most common type of pretexting is "phishing," where criminals send emails purporting to be from a legitimate organization in order to trick people into revealing sensitive information, such as passwords or credit card numbers.

Pretexting can also be done over the phone, through social media, or in person. In some cases, criminals may even pose as law enforcement officials in order to obtain information. Pretexting is a serious problem because it can lead to identity theft, financial fraud, and other types of crime. If you believe that you have been the victim of pretexting, you should contact your IT department immediately.

Discuss what type of information is typically requested during a pretexting attack

The attacker will typically pose as someone with a legitimate reason for needing the information, such as an employer, a government agency, or a financial institution. In many cases, the attacker will already have some basic information about the target, such as their name and contact details. 

Armed with this information, the attacker will then attempt to trick the target into revealing additional sensitive information, such as passwords, Social Security numbers, or bank account details. Pretexting attacks can be difficult to detect and prevent, but there are a few steps that individuals can take to protect themselves. 

First, be suspicious of any unexpected requests for personal information, especially if the request comes from someone you don't know. Second, never give out personal information in response to an unsolicited email or phone call. 

If you are unsure whether a request for information is legitimate, take the time to verify it with the organization in question before responding. In all situations, not just pretexting, if you are unsure if a request in legitimate the very best thing you can do is verify that information! 

For example, you receive an email from "your boss" asking you to purchase some gift cards for a client, even if this might be a legitimate request, the best way to ensure that you aren't being taken advantage of is to verify this request via another form of communication. Pick up the phone, text them, walk over to their office, any other form of communication that is not replying to the email that you are suspicious of.

Some Examples of Pretexting

Pretexting is considered a type of social engineering, as it relies on deception and manipulation to obtain information that would otherwise be difficult or impossible to obtain. There are many different types of pretexting, but some of the most common include phishing, pretext calling, and baiting. 

Phishing is a type of online fraud that involves sending fake emails or messages that appear to be from a trusted source, in an attempt to trick the recipient into revealing personal information. 

Pretext calling is another common type of pretexting, which involves calling someone and pretending to be from a legitimate organization in order to obtain personal information. A common example of this is someone calling you and pretending to be from the IRS. 

They use the IRS because people see this as an authoritative organization and that gives the bad actor credibility. They can use this credibility to get personal information from you such as bank account numbers or social security numbers.

Baiting is a type of pretexting that is similar to phishing, but unlike other types of social engineering it promises an item or goods to entice victims. An example of this is someone leaving a USB drive on your desk, your doorstep, or even mailing it to you. Another example would be offering a prize or reward to click on a link, something that would entice you into performing the desired action.

While these are just a few examples of pretexting, it is important to remember that anything that relies on deception with the intent to obtain personal information can be considered pretexting.

Share some tips for avoiding being victimized by pretexting

Be aware that pretexting scams exist and know how they work. This will help you to spot a fraudulent email or phone call. Do not give out personal information unless you are sure you are dealing with a legitimate organization.

If you are unsure, hang up the phone or close the email and contact the organization directly using a trusted phone number or email address. Be sure to keep your personal information safe and secure by regularly reviewing your privacy settings and using strong passwords. Also, be wary of what you put out into the world via social media, as this can be a huge tool that bad actors use to gain your trust. Public information is the easiest and fastest way to do reconnaissance on a victim.

Making sure that your staff is aware of the possibility of cyber attacks and the different types of social engineering attacks that can be used against them is a good first step in staying secure. Annual cybersecurity awareness training is a minimum first step to making sure that your organization is prepared.

To sum up...

To wrap up, pretexting is just one of the many types of social engineering attacks that you or your employees may run into. While there are many strategies to combat each type of cyber attack, the MOST important one is to verify what you are being told. It only takes a few extra minutes to pick up the phone and call your co-worker or your bank to verify an email or text message, so take the time and stay safe.

If you or one of your staff does fall victim to pretexting or any other cyber attack, don't feel bad, don't blame yourself, report it to your IT department immediately. Blaming the victim does nothing but promote an environment where you won't know when your organization has been compromised. The sooner you report an incident the sooner it can be fixed.

If you would like to learn more about how to stay aware and secure, check out our free On-Demand Cybersecurity Awareness Training.