What is pretexting? How pretexting scams work

A pretext is the invented context that makes a request seem reasonable.

"Give me your password" is a question nobody answers. "I'm from the service desk working ticket 44712 on the mailbox migration — can you confirm the username you're signed in with?" is a question people answer several times a day, because in that frame it is a normal thing to be asked.

The words changed very little. The frame changed everything.

Canada's Cyber Centre defines pretexting as using "a fabricated scenario or narrative as a pretext for contacting the target". The FTC has been prosecuting it since the 1990s. It called pretexting "the practice of getting personal information about others under false pretenses", and noted the term was coined by the private investigation industry.

How a pretexting scam works, stage by stage

The message you receive is stage three of six. Most of the work happened before you were contacted at all.

1. Research

The attacker collects enough true detail to be credible. Almost all of it is published or purchasable — see the section below.

2. Build the identity and the story

They choose a role that would plausibly make contact, a reason it is happening now, and a reason the normal process is not being followed.

3. First contact

Often asking for nothing sensitive. The purpose is to open the relationship, not to extract anything.

4. The small request

Confirm a username. Check a reference number. Answer a quick question. Each one is easy to grant, and each one deepens the pattern of cooperation.

5. The real request

Credentials, a payment, a code, remote access, or a change to bank details. By now it arrives inside an established conversation rather than as a cold approach.

6. Exit

The money moves, or the access is used, and the identity disappears. In business email compromise, Verizon's 2025 analysis found roughly 88% of proceeds left by wire transfer.

What a pretext needs to survive contact

For a targeted attack, writing the message is trivial. The effort goes into constructing a scenario that survives contact with someone who knows how things actually work.

A good pretext needs four properties:

1. A plausible identity — a role that would genuinely exist and would genuinely make contact.
2. A plausible reason for contact now — something happening that explains the timing.
3. A reason the normal process is not being followed — because the attacker cannot use the normal process.
4. A request proportionate to the identity — small enough not to trigger scrutiny.

Where the material comes from

Very little of it is stolen. Most is published, or purchasable:

• Professional profiles — job titles, reporting lines, tenure, colleagues
• Company websites — staff, suppliers, press releases, projects
• Social media — travel, absences, interests, relationships, complaints
• Job listings — the exact software a company runs, named in requirements
• Data brokers — address history, household, purchases
• Prior breaches — account details, partial card numbers, transactions

A job advert asking for experience with a specific ticketing system tells an attacker which ticketing system to reference. A post about a migration tells them what is currently happening.

The NCSC describes exactly this: attackers use information freely available on your website and social accounts — your "digital footprint" — to make targeted messages more convincing. It is the concrete mechanism by which privacy and security are the same subject.

The patterns you will actually meet

Aimed at you personally

The bank's fraud team. Often preceded by a text so the call feels expected. A real-sounding transaction is described, then you are helped to protect yourself. This is the costliest consumer pattern, and the FTC recorded the highest business-impersonation losses against bank impersonators in 2025.

The government department. A tax debt, a benefit problem, an unpaid toll. Government impersonation reports rose sharply in 2025, with about $920 million in reported losses. See authority scams.

The family member with a new number. "Hi Mum, this is my new number, I've lost my phone." The change of number, which would ordinarily be suspicious, is explained by the story itself.

The delivery or utility caller. A missed parcel, a meter reading, an engineer visit. Mundane by design.

Aimed at you at work

The service desk. A ticket reference, a real system, a genuine ongoing change. Asks you to confirm a username, then to approve a prompt — which is actually a login they are performing.

The new supplier contact. "Taking over the account from Rachel." Chases an invoice, then mentions updated bank details. Devastating in accounts payable, and the reason a bank-detail change should always be confirmed by phone on a number from your own records.

The survey or researcher. Asks nothing sensitive at all. Collects organisational structure, systems, and who handles what — building the map for the next call.

The recruiter. Flattering, patient, and asks about your responsibilities and the systems you administer, which is exactly the reconnaissance required.

The colleague locked out. The reverse direction: someone rings the help desk as an employee, and asks for a password reset.

Documented cases

Hewlett-Packard, 2006

The case that put the word into general use.

Investigators working for HP obtained the telephone records of HP board members, employees and journalists by ringing the phone carriers while impersonating the account holders, using their names, numbers and Social Security numbers. A congressional hearing was held under the title "Hewlett-Packard's Pretexting Scandal". Its chairman defined pretexting there as "using fraud, deceit and impersonation to acquire someone's personal records without his or her consent."

California's Attorney General filed criminal charges in October 2006 against the former chairwoman, an in-house lawyer and three private investigators, including counts of fraudulent wire communications and identity theft. HP settled the state's civil case for $14.5 million that December. Charges against the former chairwoman were dismissed in March 2007; the other defendants pleaded no contest to a misdemeanour, with charges to be dropped after community service and restitution.

No system was hacked. People were persuaded.

Help-desk impersonation, 2023 onwards

A joint CISA and FBI advisory documents a group that repeatedly used pretexting rather than technical exploits. According to the advisory, the actors have "posed as company IT and/or helpdesk staff using phone calls or SMS messages to obtain credentials", "posed as IT staff to convince employees to share their one-time password (OTP)", and — in the July 2025 update — "posed as employees to convince IT and/or helpdesk staff to provide sensitive information, reset the employee's password, and transfer the employee's MFA to a device they control."

That last one is worth reading twice. The pretext was aimed at the security process itself.

Operation Detect Pretext, 1999 to 2001

The FTC identified around 200 firms offering to obtain and sell consumers' financial information. It then sued information brokers who rang banks impersonating account holders. They supplied real names, addresses, dates of birth and Social Security numbers, then invented a reason for the enquiry.

Is pretexting illegal?

In the United States, several forms of it are, and this is often missed.

Financial records. The Gramm-Leach-Bliley Act makes it a violation "for any person to obtain or attempt to obtain ... customer information of a financial institution relating to another person ... by making a false, fictitious, or fraudulent statement or representation" to the institution or to its customer. Asking someone else to do it is also a violation.

Phone records. After the HP case, Congress passed the Telephone Records and Privacy Protection Act of 2006. Obtaining confidential phone records by "false or fraudulent statements or representations" is punishable by a fine, "imprisoned for not more than 10 years, or both."

Beyond those specific statutes, the conduct is usually fraud or identity theft under general law. This is not a grey area dressed up as research.

How common is it?

Pretexting is measured mainly through its most profitable outcome, business email compromise, where an attacker uses an invented or hijacked business relationship to redirect a payment.

Verizon's 2024 report noted "the clear overtaking of Pretexting as a more likely social action than Phishing", with more than 40% of social-engineering incidents involving pretexting against 31% for phishing. Its 2025 report found the two running together as "the main techniques leveraged to con employees", and noted that pretexting attacks are more common in small businesses than in large organisations.

The FBI's 2025 figures put business email compromise second only to investment fraud in total reported losses.

Pretexting compared with the terms it gets confused with

The useful distinction is that phishing, vishing and smishing name how a message arrived. Pretexting names what it claimed. They describe different axes of the same attack, which is why a message can be both.

Why the first contact asks for nothing

The strongest pretexts open with a request that is entirely safe to grant.

A quick question. A confirmation of something public. A friendly heads-up. You answer helpfully, because there is no reason not to — and three things happen:

• The attacker learns you are responsive and cooperative.
• A relationship exists, so the next message is a continuation rather than a cold approach.
• Nothing malicious was sent, so no filter or alert saw anything.

The request that matters arrives in message three or four.

Breaking a pretext

You cannot detect a pretext by examining it, because it is a story rather than a technical artefact. There is no domain to check and no header to inspect. A well-built pretext will pass every inspection you can run inside the conversation.

What breaks it is stepping outside.

Verify through a channel the contact did not supply. Ring the service desk on the number in your intranet. Ring the supplier on the number from last year's invoice. Look the person up in the company directory yourself. CISA's guidance is to verify an unknown individual's identity "directly with the company", and not to give out information about your organisation "unless you are certain of a person's authority to have the information."

Make the request type the trigger, not the message. Any request touching credentials, payments, bank details or access gets verified — by policy, every time, regardless of how ordinary it sounds. The NCSC recommends exactly this: ensure all important requests are verified "using a second type of communication (such as SMS message, a phone call, logging into an account, or confirmation by post or in-person)", and that staff know the normal way key tasks are done, so an unusual route stands out.

Judgement-based verification fails against precisely the pretexts that were worth building.

Do not accept a voice or a face as proof. Canada's Cyber Centre states it directly: "Audio or video alone should not be considered proof of identity, especially for sensitive or unusual requests." See AI scams.

Treat any explanation of why verification cannot happen as the answer. The system being down, the traveller who cannot be reached, the confidentiality requirement. That explanation exists solely to prevent the step that would end the attack.

If you think you already answered one

Work out what you actually gave away, and act on that.

• A password, on a page or over the phone — I gave a scammer my password
• A one-time code, or you approved a login prompt — same page, and sign out all devices first
• A payment, or changed bank details on an invoice — ring your bank now, and ring the supplier on a number from your own records
• Only information, with nothing sensitive — expect a follow-up call that uses it, and verify independently when it comes