What is pretexting?
Definition
Pretexting is getting someone's personal information by lying about who you are or why you need it, for example by posing as a bank employee, a colleague or the account holder.
- Category
- Attacks
- Also called
- pretext calling
- Last updated
The FTC describes pretexting as obtaining personal information under false pretenses. The word comes from private investigators: the classic case is calling a bank and posing as the account holder to learn the balance. Today the same trick is used by scammers and stalkers, over the phone, by email or in person.
The core of it is the made-up story, the pretext. The attacker picks a role that makes the request feel normal: IT support who needs your login, a bank fraud agent, a delivery driver, a government official, or you, calling your phone company. They often know a few real details about you already, which makes the story convincing, and each answer they get helps them ask for the next.
Examples
- Someone calls your phone carrier as you, to get your call records or take over your number.
- A caller says they're from your bank's fraud team and needs to "verify" your account details.
- An email from your "manager" asks you to send employee records for an urgent task.
Pretexting vs. phishing
Phishing usually relies on a fake message and a link or attachment sent to many people. Pretexting is a built scenario, often aimed at one person and played out in conversation. Both are forms of social engineering.
Is it illegal?
The FTC has taken action against pretexting. The Gramm-Leach-Bliley Act bars getting customer financial information from a financial institution by false statements. Phone records have been handled under other laws. Rules differ by country, so this isn't legal advice.
How to protect yourself
- 1
Don't give details to someone who contacted you
Hang up and call back on a number from your card, bill or the company's official site.
- 2
Slow down when a request is urgent
Pressure and a plausible role are the pretext. A real organization will let you verify first.
- 3
Keep your details hard to find
Pretexters use real facts about you, like your address, relatives and phone number, to sound credible. Serus finds where that information is listed and removes it, so there is less for them to use.
- 4
Add a PIN or passcode to sensitive accounts
Ask your phone carrier and bank about an account PIN, so a caller who only knows your details can't act as you.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What is an example of pretexting?
Someone phones your mobile carrier pretending to be you and asks for your account details or a SIM change. They succeed because the story and a few known facts sound right.
How is pretexting different from social engineering?
Social engineering is the broad term for manipulating people into giving up information or access. Pretexting is one technique within it, built on an invented scenario.
Is pretexting a crime?
It can be. In the US the Gramm-Leach-Bliley Act prohibits it for financial information, and the FTC has brought cases over it. It depends on what was obtained and where you live.
Sources
Something wrong or out of date? Tell us and we'll re-check it.