Pretexting

Pretexting is the fabricated backstory underneath most social engineering — a convincing role and reason (a new vendor, an auditor, an exec’s assistant) built well enough that the target complies without a second thought. It’s less a technique on its own than the setup that powers phishing, vishing & smishing, and business email compromise: the story that makes the ask feel routine.

Common Techniques

• Authority, urgency, and familiarity plays — posing as a boss, auditor, or known vendor with a request that can’t wait.
• OSINT-built personas — public org charts, LinkedIn, and press releases supply the names and details that make a cover story check out.
• Multi-touch trust building — several small, plausible interactions before the real ask, so the final request looks like a continuation.
• Physical pretext — tailgating into a badge-controlled space or posing as an “IT contractor” on-site.
• Impersonating trusted third parties — payroll providers, auditors, or partner companies staff are conditioned to cooperate with.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Testing

An authorized assessment starts with OSINT and scenario design — building a pretext that matches how the organization actually operates — then runs measured attempts across phone, email, and on-site under strict rules of engagement. Record exactly what worked, what the target verified, and what they didn’t. Keep that trail in the pentest report so the writeup shows which levers actually moved people.

Remediation

Build a verification culture: challenge unfamiliar requesters and confirm sensitive asks through a callback on a known number, not a number the caller supplies. Enforce least-privilege access alongside clean-desk and visitor-escort controls so a successful pretext still hits a wall. Reduce the public OSINT footprint that fuels convincing personas, and train staff on the specific manipulation levers — authority, urgency, familiarity — rather than “social engineering” in the abstract.