What Is Pretexting? Techniques, Examples, and Prevention

Every successful scam begins with a believable story. Pretexting is the craft of building that story, a fabricated scenario, role, or identity designed to make a target lower their guard and hand over information, access, or money they would never give a stranger.

Pretexting attacks the person, not the system. The technique underpins the corporate fraud known as business email compromise, which the FBI's Internet Crime Complaint Center ties to more than $55 billion in losses worldwide.

What Is Pretexting?

Pretexting is a social engineering technique in which an attacker invents a false scenario, the pretext, to manipulate a victim into divulging information or performing an action. The pretext supplies a plausible reason for the request, so the target complies without suspicion.

Every pretext combines two elements: a character and a situation. The character is the identity the attacker assumes, such as a bank officer, an IT technician, or a senior executive, while the situation is the story that makes the request feel urgent and reasonable.

Pretexting sits beneath most other social engineering. A phishing email, a vishing call, or a deepfake video works only because a convincing pretext gives the victim a reason to act, which makes pretexting the engine rather than a separate attack.

How Does Pretexting Work?

A pretexting attack unfolds in four stages, each building on the last.

1. Reconnaissance

The attacker gathers details before making contact. Public sources, social media, leaked data, and company websites supply the names, roles, projects, and vocabulary that make a pretext sound authentic.

2. Building the Pretext

Research becomes a story. The attacker picks an identity and a scenario tailored to the target, so a finance clerk hears from the CFO about an urgent payment, while an employee hears from IT about a mandatory password reset.

3. Establishing Trust

Contact opens with credibility, not the request. The attacker references real details, mirrors internal language, and behaves exactly as the impersonated party would, lowering the target's guard before anything is asked.

4. Exploiting the Target

With trust in place, the ask arrives. The victim shares a credential, approves a transfer, or grants access, believing they are helping a legitimate colleague, customer, or authority.

Pretexting vs Phishing

Pretexting and phishing overlap constantly, yet they name different things. Phishing is a delivery method, while pretexting is the story that delivery carries.

In practice, the two fuse. A spear-phishing email impersonating a supplier is phishing in form and pretexting in substance, which is why the most damaging attacks combine both.

Common Pretexting Techniques

Attackers deploy pretexting through a recognizable set of scenarios:

• Executive impersonation, or CEO fraud. Posing as a senior leader to pressure staff into urgent wire transfers or data disclosure, the core of business email compromise. CloudSEK has tracked CEO impersonation campaigns that reach executives through messaging apps using the leader's public photos.
• Vishing. Voice-based pretexting over the phone, often impersonating a bank, a vendor, or an internal help desk.
• Tech-support scams. Claiming a device is infected to gain remote access or extract payment and credentials.
• Vendor and invoice fraud. Impersonating a known supplier to redirect a legitimate payment to an attacker-controlled account.
• Help-desk pretexting. Calling internal IT while posing as an employee to reset a password or bypass multi-factor authentication.
• Baiting. Offering something desirable, a prize, a document, or a device, to lure the target into engaging.

Major Pretexting Attacks

Pretexting has driven some of the most consequential frauds on record, long before deepfakes entered the picture.

HP boardroom scandal (2006). Investigators hired by Hewlett-Packard impersonated board members and journalists to pull their private phone records while hunting a boardroom leak. The case put pretexting in the public eye and prompted the US Telephone Records and Privacy Protection Act, which made obtaining phone records by pretext a federal crime.

Google and Facebook (2013 to 2015). Evaldas Rimasauskas posed as Quanta Computer, a hardware supplier both firms used, and sent convincing fake invoices from a lookalike company. The two paid out more than $100 million combined before the fraud surfaced.

Ubiquiti Networks (2015). Attackers impersonating company executives instructed the finance department to wire funds to overseas accounts, costing the networking firm $46.7 million. Weak payment verification, not a system breach, made it work.

In each case, no firewall was defeated, and no malware ran. A believable story did the work, which is the defining trait of every pretexting attack.

How AI Is Escalating Pretexting

Artificial intelligence has removed the hardest part of pretexting: sounding exactly like the person being impersonated. Voice cloning needs seconds of audio, and real-time deepfake video puts a fabricated executive on a live call.

The Arup fraud made the danger concrete. In early 2024, a finance employee at the engineering firm joined a video call with the company's CFO and several colleagues, then approved fifteen transfers worth roughly $25 million. Every other face on that call was an AI-generated deepfake, and the theft came to light only when the employee later checked with headquarters, as CFO Dive reported.

A near-identical attempt targeted the advertising group WPP, cloning its chief executive's voice from public footage to set up a fraudulent call. Deepfakes break the assumption that seeing and hearing a person confirms their identity. Verification habits that once caught pretexting, recognizing a familiar voice or face, now validate the attacker instead, which pushes defense toward process rather than perception.

Signs of a Pretexting Attack

Pretexting hides behind plausibility, though certain pressure tactics recur:

• Urgency manufactured to discourage the target from pausing to verify.
• Secrecy demands, framing the request as confidential or too sensitive to discuss.
• Authority pressure invoking a senior executive or an official body.
• Process shortcuts that bypass normal approval, such as an out-of-band payment.
• Resistance to verification, with excuses for why a callback is impossible.
• Inconsistencies in email addresses, phone numbers, or account details.

How to Prevent Pretexting

Because pretexting targets people, defense combines habits, process, and technology.

For Individuals

• Verify out of band. Confirm any sensitive or financial request through a separate, known channel, never the one that delivered it.
• Resist urgency. Treat pressure to act immediately as a warning sign rather than a reason to comply.
• Guard personal detail. Limit the information shared publicly that an attacker draws on to build a pretext.

For Organizations

• Mandate callback procedures. Require verification of payment and account changes against pre-established contacts.
• Enforce dual authorization. Split approval of large transfers across two people, so a single call cannot move funds alone.
• Train against real scenarios. Run awareness exercises that include vishing and deepfake pretexts, not email alone.
• Apply least privilege. Limit what any single account or role reaches or authorizes if a pretext succeeds.

How CloudSEK Detects Impersonation Behind Pretexting

Pretexting begins long before the phone rings. Attackers register lookalike domains, spoof executive profiles, and mine leaked data to make their story convincing, and that preparation is visible to anyone watching the right places.

CloudSEK's XVigil monitors the surface, deep, and dark web for executive and brand impersonation, lookalike domains, fake social profiles, and the exposed employee data that fuels a convincing pretext. Catching that groundwork lets an organization take down a spoofed domain or flag a leaked dataset before it becomes the opening move of an attack. It addresses the impersonation and reconnaissance layer, complementing rather than replacing the process controls and training that stop a pretext at the moment of the request.

Frequently Asked Questions

Is pretexting illegal?

Yes, pretexting is illegal in most jurisdictions, prosecuted as fraud, identity theft, or wire fraud. In the United States, obtaining financial information under false pretenses is specifically barred by the Gramm-Leach-Bliley Act.

Is pretexting the same as impersonation?

No, impersonation is one tool used within pretexting, not the whole technique. Pretexting is the fabricated scenario, and impersonating a specific person is one common way to make that scenario believable.

What information do attackers seek through pretexting?

Attackers pursue login credentials, financial data, payment approvals, and personal information, along with direct access to systems. Each one serves as a step toward fraud or a deeper breach.

Who do pretexting attacks usually target?

Finance, human resources, and IT staff are common targets because they control money, personal data, and system access. Executives are impersonated as often as they are targeted directly.

How do you report a pretexting attack?

Report it immediately to the bank to attempt a recall of funds, then to law enforcement such as the FBI's IC3 in the United States. Notifying internal security and preserving the messages supports any investigation.

Does pretexting always involve technology?

No, pretexting predates the internet and still works in person or over the phone. The fabricated story is the constant, while the channel is interchangeable.