A caller says they are from your bank’s fraud team, already “knows” your name and the last digits of your card, and just needs to confirm a few details. The story is airtight, the manner professional — and entirely invented. That invented backstory is pretexting, the craft of building a believable scenario to pry information loose. Our GetMyPassword team explains what pretexting is and how to resist it.
What pretexting is
Pretexting is a social-engineering technique where an attacker invents a plausible scenario and a false identity — a “pretext” — to gain your trust and extract information or actions. Rather than a clumsy demand, it is a crafted story: the IT technician who needs your login to “fix” an issue, the bank investigator confirming a “suspicious charge,” the delivery service verifying your address, the coworker from another office needing a file. The details are often real, gathered beforehand, which makes the role convincing and lowers your guard.
Common pretexts to watch for
- “Bank or fraud department” confirming details after a “suspicious transaction.”
- “IT support” needing your password or remote access to fix a problem.
- “A vendor or coworker” requesting a file, payment, or login change.
- “A government or utility official” verifying your identity or account.
- Known real details used up front to make the role believable.
Why a good story works
Pretexting exploits trust, context, and helpfulness rather than fear alone. Because the scenario fits something plausible — a real bank, a real workplace, a real delivery — your instinct is to cooperate, especially when the caller already knows some of your information. Attackers also lean on authority and routine, presenting the request as standard procedure. The key insight is that knowing details about you is not proof of identity: data leaks and public profiles supply those details. Real organizations can verify themselves to you, not the other way around.
Knowing your name and last four digits is not proof of identity — it is the script. Legitimate organizations can prove who they are to you; a caller who flips that around is performing a pretext.
How to protect yourself
When someone contacts you with a request for information, access, or payment, stop and verify independently — hang up and call the organization back on a number you look up yourself. Never give passwords, one-time codes, or remote access on an inbound call, and remember that real support never needs your password. Limit what you overshare publicly, and protect accounts with two-factor authentication and a unique password from our password generator, so a convincing story alone cannot unlock them.
Frequently asked questions
What is pretexting?
Pretexting is a social-engineering technique where an attacker invents a believable scenario and false identity to win your trust and extract information or actions, such as posing as IT support, a bank investigator, or a coworker.
How is pretexting different from phishing?
Phishing usually relies on a fake message and a malicious link, while pretexting centers on a crafted backstory and impersonation, often by phone or in person. Pretexting frequently sets up or strengthens a phishing or fraud attempt.
How do I protect myself from pretexting?
Verify any request independently by calling the organization on a number you look up yourself, never share passwords, codes, or remote access on an inbound contact, and remember that knowing details about you is not proof of identity.