What is pretexting? An invented story that makes a request for money, data or access feel routine. Verizon's 2026 DBIR found a human element in 62% of breaches. Why conscientious people get caught, and how callbacks stop it.
What is pretexting? Pretexting is social engineering built on an invented story: someone poses as a person you have good reason to trust, such as a supplier, an auditor, IT support or your own CEO, so that a request for information, access or money feels like part of an ordinary day. The story carries the attack. The request at the end is usually small.
The term is older than email. An FTC statement to Congress describes it as "a term coined by the private investigation industry" for "obtaining personal information under false pretenses." It sits underneath most of the techniques covered in how phishing actually works and how to spot it, which is why it is worth understanding on its own.
NIST's security guidance for organizations handling controlled information lists the family together: "Social engineering includes phishing, pretexting, impersonation, baiting, quid pro quo, threadjacking, social media exploitation, and tailgating." Pretexting is the one that depends most on a conversation.
Verizon's 2026 Data Breach Investigations Report draws the line clearly. It defines pretexting as a tactic "in which a trusted relationship is built through concocted scenarios to trick the user into taking an action that unknowingly compromises the organization, frequently by voice communications but also seen via email or text messaging." The full report puts it more simply: "If there is someone on the other side of the proverbial line interacting with you to do something you shouldn't, that's Pretexting."
A phishing email is sent and waits. A pretext talks back, adjusts when you hesitate, and answers your questions with more story. That is why Verizon counts voice phishing, the subject of what is vishing, as pretexting. Verizon's full 2026 report found a human element in 62% of breaches.
Most pretexts have the same four parts: a role, a reason, a deadline and a small ask. The role borrows someone else's standing. The reason explains why the usual process does not apply this time, and the deadline removes the time you would have used to check.
In a $5M to $50M company, the roles are predictable because they mirror real working relationships:
That last one is common enough that the FTC published a consumer alert in January 2026: an unexpected text, email or call from your "boss" asking for an urgent favor, usually to buy gift cards and send the numbers. The FTC's advice is to check with your boss using a number or email you know is real, and it notes that only scammers ask for gift card numbers and PINs.
I study behavioral psychology, and pretexting is a close reading of how decent people behave at work. It does not target carelessness. It targets the habits that make someone good at their job: answering quickly, following instructions from senior people, and not leaving a colleague or customer stuck.
Three pressures do most of the work. Authority: the request arrives under the name of someone whose instructions you normally follow, so questioning it feels like insubordination. Urgency: a deadline compresses the time available to think, the same lever covered in artificial urgency in technology sales. Reciprocity: a caller who has just "fixed" something for you, or been patient and friendly, creates a quiet pull to return the favor when the small ask comes.
The result is that the safe action, pausing to check, is made to feel like the rude one. The person who gets caught is often the most conscientious person on the team, which is the point made in the problem isn't you. Treating it as a personal failing makes the next report less likely, not more.
Awareness alone does not close the gap. A large study of over 19,500 employees at UC San Diego Health found "no significant relationship" between recently completing awareness training and the likelihood of failing a phishing simulation. Does security awareness training work looks at what that means for your program. The short version for pretexting: build the check into the process, so nobody has to win an argument with a convincing stranger.
Every pretext depends on one thing: that you respond inside the channel the attacker controls. Take the conversation somewhere they cannot follow and the story has nothing to stand on. Three government agencies give the same advice independently.
CISA advises that if you are unsure whether a request is legitimate, contact the company directly and "do not use contact information provided on a website connected to the request; instead, check previous statements for contact information." The FBI's business email compromise guidance says to "use secondary channels and/or two-factor authentication to verify requests for changes in account information." FinCEN's advisory to financial institutions says to verify emailed payment instructions "by using multiple means of communication or by contacting others authorized to conduct the transactions."
For an operating company, that turns into a few written rules:
Each of those adds a small amount of friction on purpose, the trade-off explored in the case for friction. The cultural half matters as much as the rules: people report what they are not punished for, which is the subject of building a security culture when everyone thinks it's IT's job.
If a request feels off, stop and do not reply, click or call any number it gives you. Read the real sender address or domain letter by letter. Look the company or person up yourself and call back on a number you already have. If your company allows it, screenshot the message (crop out customer and personal data first, and never upload an attachment) and ask your approved AI assistant whether the company is real, the domain matches, and the request fits a known scam; treat the answer as a second opinion. Report it the company way, even if you did nothing wrong. If money or a login was involved, call your bank to request a recall and file at ic3.gov. The full walkthrough is in how to check if a message is a scam.
At Kief Studio we build the verification into the systems themselves, so a bank detail change or an access request cannot go through on one person's say-so, however good the story is. We also run remote team sessions on exactly this: the requests your staff actually receive and the checks that stop them. In-person sessions in Central Massachusetts are available, scoped in advance. Brian Gagne leads the security engineering; briansgagne.com goes deeper on the technical side.
Pretexting is getting information, access or money by pretending to be someone with a legitimate reason to ask. The FTC describes it as obtaining personal information under false pretenses, such as posing as an account holder to learn a bank balance.
They overlap but differ. Verizon describes phishing as a message that is sent and waits, while pretexting involves someone actively interacting with you, often by phone, text or a live email thread, to talk you into an action.
Common enough to plan for. Verizon's 2026 Data Breach Investigations Report found a human element in 62% of breaches, and pretexting is one of the most direct routes to that human. Verizon also classifies voice phishing as pretexting.
Verification through a separate channel you already trust. CISA, the FBI and FinCEN all advise confirming requests by contacting the person or company directly using contact details you already have, never the ones supplied in the request.
Anyone who can move money, reset access or release data: accounts payable, payroll, the help desk, HR and executive assistants. Those roles benefit most from a written rule that every change is confirmed on a known number.
What is quishing? Phishing hidden in a QR code, so nobody can read the link before scanning. The FBI warned in January 2026 that quishing pushes victims from work computers to phones, past email security controls.
What is smishing? Phishing by text, aimed at the phone in every employee's pocket. Imposter scams were the most-reported fraud to the FTC in 2025, with $3.5 billion lost. Here is what work-targeted texts look like and how to report them to 7726.
Phishing isn't just bad grammar in a Nigerian prince email anymore. AI-generated phishing is personalized, grammatically perfect, and harder to spot than ever.
Work With Us
Kief Studio builds, protects, automates, and supports full-stack systems for businesses up to $50M ARR.
Newsletter
Strategy, psychology, AI adoption, and the patterns that actually compound. No spam, easy to leave.
Subscribe
