What is pretexting? Pretexting is social engineering built on an invented story: someone poses as a person you have good reason to trust, such as a supplier, an auditor, IT support or your own CEO, so that a request for information, access or money feels like part of an ordinary day. The story carries the attack. The request at the end is usually small.

The term is older than email. An FTC statement to Congress describes it as "a term coined by the private investigation industry" for "obtaining personal information under false pretenses." It sits underneath most of the techniques covered in how phishing actually works and how to spot it, which is why it is worth understanding on its own.

A blank plastic ID badge on a lanyard lying on black glass, its edge lit hot pink, illustrating what is pretexting: a borrowed identity — A pretext is a borrowed identity with a reason attached. The badge does not need to be real, only believable for a few minutes.

What is pretexting, and how is it different from phishing?

NIST's security guidance for organizations handling controlled information lists the family together: "Social engineering includes phishing, pretexting, impersonation, baiting, quid pro quo, threadjacking, social media exploitation, and tailgating." Pretexting is the one that depends most on a conversation.

Verizon's 2026 Data Breach Investigations Report draws the line clearly. It defines pretexting as a tactic "in which a trusted relationship is built through concocted scenarios to trick the user into taking an action that unknowingly compromises the organization, frequently by voice communications but also seen via email or text messaging." The full report puts it more simply: "If there is someone on the other side of the proverbial line interacting with you to do something you shouldn't, that's Pretexting."

A phishing email is sent and waits. A pretext talks back, adjusts when you hesitate, and answers your questions with more story. That is why Verizon counts voice phishing, the subject of what is vishing, as pretexting. Verizon's full 2026 report found a human element in 62% of breaches.

How does a pretext work?

Most pretexts have the same four parts: a role, a reason, a deadline and a small ask. The role borrows someone else's standing. The reason explains why the usual process does not apply this time, and the deadline removes the time you would have used to check.

In a $5M to $50M company, the roles are predictable because they mirror real working relationships:

A "new account manager" at a freight carrier asks accounts payable to confirm the remittance details on file before month end. That is the opening move of business email compromise.
"IT support" calls a clinic office manager about a mailbox migration and needs the code that just arrived by text.
An "auditor" from a firm the CFO really uses asks HR for a current employee list with start dates.
The CEO, apparently between flights, texts the office manager for a quick favor.

That last one is common enough that the FTC published a consumer alert in January 2026: an unexpected text, email or call from your "boss" asking for an urgent favor, usually to buy gift cards and send the numbers. The FTC's advice is to check with your boss using a number or email you know is real, and it notes that only scammers ask for gift card numbers and PINs.

A high-visibility vest and a hard hat hanging on a single hook against black, lit only by hot pink light, the costume behind pretexting — The role is chosen to fit the request: the contractor, the auditor, the help desk. Each one comes with a reason to skip the usual steps.

Why do helpful, conscientious people fall for pretexting?

I study behavioral psychology, and pretexting is a close reading of how decent people behave at work. It does not target carelessness. It targets the habits that make someone good at their job: answering quickly, following instructions from senior people, and not leaving a colleague or customer stuck.

Three pressures do most of the work. Authority: the request arrives under the name of someone whose instructions you normally follow, so questioning it feels like insubordination. Urgency: a deadline compresses the time available to think, the same lever covered in artificial urgency in technology sales. Reciprocity: a caller who has just "fixed" something for you, or been patient and friendly, creates a quiet pull to return the favor when the small ask comes.

The result is that the safe action, pausing to check, is made to feel like the rude one. The person who gets caught is often the most conscientious person on the team, which is the point made in the problem isn't you. Treating it as a personal failing makes the next report less likely, not more.

Awareness alone does not close the gap. A large study of over 19,500 employees at UC San Diego Health found "no significant relationship" between recently completing awareness training and the likelihood of failing a phishing simulation. Does security awareness training work looks at what that means for your program. The short version for pretexting: build the check into the process, so nobody has to win an argument with a convincing stranger.

A person holding an office door open for a silhouetted figure carrying boxes, the hallway lit hot pink against black, why helpful people get caught by pretexting — Holding the door is good manners. A pretext is designed so that the courteous response is also the one that lets it in.

How do you make a pretext fail?

Every pretext depends on one thing: that you respond inside the channel the attacker controls. Take the conversation somewhere they cannot follow and the story has nothing to stand on. Three government agencies give the same advice independently.

CISA advises that if you are unsure whether a request is legitimate, contact the company directly and "do not use contact information provided on a website connected to the request; instead, check previous statements for contact information." The FBI's business email compromise guidance says to "use secondary channels and/or two-factor authentication to verify requests for changes in account information." FinCEN's advisory to financial institutions says to verify emailed payment instructions "by using multiple means of communication or by contacting others authorized to conduct the transactions."

For an operating company, that turns into a few written rules:

No payment detail changes on one person's word. Any new or changed bank account is confirmed by calling a number already on file, never one in the request.
The help desk calls back. Password resets, new phones and MFA changes are confirmed through a known number or in person.
Data requests go through a named owner. Employee lists, customer exports and banking letters leave the building only after a second person agrees.
"I'll call you back" is always allowed. Leadership says so out loud, including about requests that appear to come from leadership.

Each of those adds a small amount of friction on purpose, the trade-off explored in the case for friction. The cultural half matters as much as the rules: people report what they are not punished for, which is the subject of building a security culture when everyone thinks it's IT's job.

An empty leather executive chair in a dark office, lit from one side by hot pink light, the borrowed authority used in pretexting — The most effective pretexts borrow the authority of someone who is not in the room. A callback puts the real person back in it.

Not sure? Check before you act

If a request feels off, stop and do not reply, click or call any number it gives you. Read the real sender address or domain letter by letter. Look the company or person up yourself and call back on a number you already have. If your company allows it, screenshot the message (crop out customer and personal data first, and never upload an attachment) and ask your approved AI assistant whether the company is real, the domain matches, and the request fits a known scam; treat the answer as a second opinion. Report it the company way, even if you did nothing wrong. If money or a login was involved, call your bank to request a recall and file at ic3.gov. The full walkthrough is in how to check if a message is a scam.

At Kief Studio we build the verification into the systems themselves, so a bank detail change or an access request cannot go through on one person's say-so, however good the story is. We also run remote team sessions on exactly this: the requests your staff actually receive and the checks that stop them. In-person sessions in Central Massachusetts are available, scoped in advance. Brian Gagne leads the security engineering; briansgagne.com goes deeper on the technical side.

Frequently Asked Questions

What is pretexting in simple terms?

Pretexting is getting information, access or money by pretending to be someone with a legitimate reason to ask. The FTC describes it as obtaining personal information under false pretenses, such as posing as an account holder to learn a bank balance.

Is pretexting the same as phishing?

They overlap but differ. Verizon describes phishing as a message that is sent and waits, while pretexting involves someone actively interacting with you, often by phone, text or a live email thread, to talk you into an action.

How common is pretexting?

Common enough to plan for. Verizon's 2026 Data Breach Investigations Report found a human element in 62% of breaches, and pretexting is one of the most direct routes to that human. Verizon also classifies voice phishing as pretexting.

What is the best defense against pretexting?

Verification through a separate channel you already trust. CISA, the FBI and FinCEN all advise confirming requests by contacting the person or company directly using contact details you already have, never the ones supplied in the request.

Who in a company is most likely to be targeted by pretexting?

Anyone who can move money, reset access or release data: accounts payable, payroll, the help desk, HR and executive assistants. Those roles benefit most from a written rule that every change is confirmed on a known number.

Pretexting

What Is Pretexting? The Story Behind Social Engineering