Pretexting is the creation of a fabricated scenario — the "pretext" — to manipulate a target into providing information or taking an action. Unlike a quick phishing email, pretexting often involves sustained engagement over time to build trust before making the actual request.
The IT Support Scam
This is one of the most effective pretexting attacks because it exploits a new employee's desire to be helpful and avoid causing problems:
- Research: The attacker finds a new hire announced on LinkedIn or the company's "Meet the Team" page. They note the person's name, role, and start date.
- Initial Contact: The attacker calls the new hire: "Hi [Name], this is Steve from IT. Welcome aboard! We're seeing an alert that your laptop's configuration isn't syncing correctly with our directory server — it's a common issue with new setups."
- Building Trust: The attacker demonstrates knowledge of internal systems, uses correct terminology, and is friendly and patient. They may even "fix" a minor issue to establish credibility.
- The Ask: "I can push the fix remotely, but our system requires me to verify your credentials to restart the sync service on your end. Can you confirm your username and current password?"
- Betrayal: The new hire, wanting to be a good employee and fix the "problem" quickly, provides their credentials. The attacker now has valid access to the corporate network.
The attacker didn't exploit a single line of code. They exploited the new hire's desire to make a good impression and their lack of familiarity with what IT support actually does and doesn't ask for.
Pretexting at Scale: The Verizon Data Breach Investigations Report
The Verizon DBIR consistently reports that pretexting is the #1 social engineering tactic used in financially motivated attacks, surpassing phishing in some sectors. Business Email Compromise (BEC) — where attackers impersonate executives or vendors to authorize fraudulent payments — caused over $2.9 billion in losses in a single year according to FBI IC3 data.
The Mitigation: Establish a clear, written policy that IT support will never ask for a password. Passwords are not needed for remote administration — administrators use privileged accounts. Any request for a password is, by definition, suspicious. New employee onboarding should explicitly cover this policy on day one.
A common security interview question is: "How would you reduce the risk of pretexting attacks in a large organization?" Weak answers focus only on technical controls. Strong answers address the full stack: (1) written policy that IT never asks for passwords, (2) new employee security onboarding that explicitly covers social engineering, (3) a clear, low-friction reporting channel so employees report suspicious contacts without fear of embarrassment, and (4) simulated pretexting exercises to test and reinforce training.