What is a pretexting attack and how to prevent it

What is pretexting?

Pretexting is a social engineering tactic used by fraudsters who invent fake scenarios to get victim’s personal information or make them perform certain actions (e.g. make a payment, download malware etc.). To achieve their goals, they’ll impersonate people you trust, like your coworkers, tech support agents, bank representatives, government officials, etc.

The reasons behind pretexting may vary. Criminals might use it to extract confidential or sensitive information, seek monetary gain, or use it for entertainment. Law-enforcement agencies and private investigators sometimes employ pretexting too. They use it to obtain information from criminals.

Similarly to spear phishing, pretexting is a focused attack that requires a lot of research. A cybercriminal needs a believable scenario, therefore, has to prepare for questions a victim might ask and know the way the impersonated person communicates.

Pretexting examples

Tech-support scam

Your company’s tech-support representative calls you and claims that they need to check whether an internal money-transfer system is working. They give you a bank account number for the transfer, and also ask for your corporate account login data to check whether it works properly.

You trust this person because they identify as a representative from a known company, they sound professional and know all the tech terms. You do all they ask, and the next thing you know the fraudster is gone with your money and login credentials.

Tailgating (or piggybacking) scam

You enter the office with your access card, and a pizza delivery guy walks in behind you. There should be pizzas in the office today, so you let him in. Later on, you find that this person was an impostor. He accessed a laptop someone left in the kitchen and transferred a few sensitive documents onto his USB.

Such scammers could also pretend to be cleaners, plumbers, electricians, or anyone who’s doing some maintenance work and is usually unnoticeable by office workers.

Email pretexting

Cybercriminals can also send pretexting emails. For example, they can impersonate your CEO and ask you to send them some sensitive data. They usually claim they need it for some urgent operations such as money transfer for a very important order or a software maintenance task. They play with fear and urgency here. The scammer claims you need to do it very quickly or, otherwise, some damaging consequences might occur (e.g. financial loss, server malfunction, etc.). You don’t have time to check whether the request is legitimate, so you send the info to a spoofer.

How to prevent pretexting

To minimize your chances of falling for pretexting, follow these steps:

1. If someone contacts you and you have a suspicion they might be scammers, end the conversation. Then try to contact the person or organization directly. Don’t call the same number, get the number from their official source;
2. Check the incoming emails. If you see something unusual, like misspelled words or odd symbols in their email address, consider it a red flag;
3. Enable email filtering to weed out potentially harmful emails;
4. Question the scammer and never give out any sensitive data to someone you don’t trust 100%;
5. Remember that most legitimate companies don’t do business in a single call. They’ll always follow up;
6. If you see a stranger entering your office building, politely take them to the administrator instead of letting them go through;
7. Don’t give into panic, fear, and urgency. Try to keep your head cool and double-check the facts.
8. Check out our Threat Protection feature. It helps you identify malware-ridden files and malicious websites before they reach your device.