What is Pretexting and How to Prevent it? A Complete Guide

Digital fraud, or cybercrime, is becoming a primary concern of the business industry. In today’s era, digital crime has overtaken old methods of fraud. For instance, pretexting attacks are a major concern for cybersecurity experts, as they account for over 40% of social engineering attacks today! Pretexting is like the heart of almost every social engineering attack covering all individuals as well as BEC (Business Email Compromise) attempts. This blog will cover pretexting scams in detail, highlighting real-life scenarios, key examples, global regulations, and ways to prevent them without giving away your data. So let’s dive in!

What is Pretexting?

Pretexting is all about the scenario, it is more of a strategic plan which serves as the foundation of most social engineering attacks. Let’s understand it with an example. Suppose you receive an email from your organization mentions that, “The IT department is resetting old passwords for security purposes” It further asks you to share all the current passwords by replying to this email as they are only tracking responses from this email. There are chances that you will reply to this email if it looks convincing. How will it look convincing? This is where pretexting comes in. You will see that the email is forwarded to all the employees of your organization and also concludes with a friendly regard, “Hope to see you tomorrow!” 

All these little details are part of the pretexting attack process. And that is how attackers get their hands on sensitive business information. In simple terms, pretexting is a false narrative that is curated in such a way that it looks real and deceives even C-level executives. 

Pretexting vs Phishing

So, the first question that comes into your mind is this: What is the difference between Pretexting and Phishing? The major difference is that Phishing is an attack itself while pretexting is a plan, strategy, or setup that helps in the execution of future social engineering attacks. Be it a phishing attack, a BEC, or ransomware, the story behind every attack is a pretext.  Let’s have a quick elaboration on this question as well. Suppose a person (attacker) dresses up as a third-party vendor and arrives at your workplace pretending to have an appointment with your business stakeholders. Now to build the trust even further, he may even wear a badge or a fake ID card that contains the vendor’s logo. This disguise and the whole plot are the pretexts, while the action that leads the stakeholders to believe their story is collectively a phishing attack.

Types of Pretexting

Pretexting is more focused on plot and scenario and has different types for different levels of story building and social engineering. Some of them are as follows:

Tailgating

Tailgating in cybersecurity is a pretexting strategy that enhances a social engineering attack, allowing attackers to gain access to facilities. As the term suggests, tailgating involves closely following someone to enter a facility or area without any form of authentication. Considering the earlier example of third-party vendors, this type of attack leads people in the vicinity to believe that the individual entering the facility is authorized. However, once the attacker reaches the entrance, they can block entry and exit points with objects to bypass security protocols, allowing them to leave the facility (after accomplishing their objective) entirely unnoticed. 

Piggybacking

Piggybacking is similar to tailgating except the only difference is that the attacker (impersonated as the vendor) will make the person aware of his presence. This helps them to “piggyback” off the credentials. For instance, the attacker watches authorized personnel approaching a restricted facility, and as the person logs into the area, the attacker asks for help right at that moment. He/she claims to have forgotten their access card or employee badge or sometimes carries heavy boxes or office equipment to make them open the area for convenience. In most cases, a piggybacking type of pretext attack works as the authorized people decide to help these individuals get inside effortlessly.

Baiting

Baiting, as the word suggests, is a type of pretext attack in which attackers use a trap or a “bait” to lure the victim. For instance, fraudsters can ask someone to check a device such as USB, mobile, or any electronic equipment on the authorized PC or server. The device they provide contains malware or scripting software that is installed on the host system automatically. This causes data leakage and breach. In this type of pretexting attack, the flash drive is the bait. Hackers can deploy baits online as well with malicious links and enticing advertisements. They can lead business employees and executives as well into traps that infect their enterprise hardware and resources in the long run. 

Scareware

Scareware is a pretexting type that works on the elements of threat and fear. It mostly drags the user to the extent that they give away their data in fear or fright of losing their assets. This is why it is called scareware due to its fictitious threat and false alarms. For instance, a pop-up notification prompts the user that their data is being compromised. To fix this issue download and install this “free malware removal tool” that will perform a deep scan. That malware removal tool benefits the attacker as the user gives full access to their storage to the software. The fraudsters can easily take their favorite data and encrypt it for blackmailing the user in the future. This pretexting attempt is also common on piracy websites and applications. Moreover, it can also be transferred via spam emails and social media invite links. 

Pretexting at the Business Level

There are many examples of pretexting attacks on individuals such as spam emails, or malware websites. However, this attack gets severe and more challenging on a business level. It also requires the attackers to perform complete organizational research to pursue the attack. Fraudsters feed on business data to learn about the company structure, their shareholder details, their way of working, and digital channels to craft a personalized strategy. This helps attacks to carry out high-profile impersonation attacks. Let’s take a look at some real-life scenarios of social engineering attacks with pretexting strategies to understand what is pretexting in cybersecurity. 

Real-Life Scenarios of Pretexting 

Pretexting attacks are dangerous, even for large-scale businesses (enterprises) as they can sabotage credibility and security easily. Many cases of pretexting attacks are reported to the authorities by businesses. Here are some real-life examples of social engineering where pretexting was central:

• In 2006, a popular electronic device manufacturer, Hewlett-Packard (HP) hired private detectives for their organization to scrutinize board members for leaking data to the media. For this job, the private investigators acted as board members to obtain the necessary data. They tracked their call logs and data from phone carriers.
• In 2015,  a network company that sells wired and wireless products, Ubiquiti Networks, fell for a pretexting attack. The attackers impersonated their senior executives and took $40 million from the members of the company. 
• In 2017, the attacker acted as a contractor and approached MacEwan University staff. They asked them to update their payment information and sent an email to easily perform the desired action. Via this phishing attack, the staff lost almost $9 million to the fraudsters. 

All the above examples show real-life pretext attacks. Impersonation as a business insider is a similar pattern across each of these scenarios. Therefore, it is recommended to always double-check the identity of a person before sharing any sensitive information with them online. It also includes people who refer to you as your boss or director of the organization, and even co-workers. 

Pretexting examples

Imposter scams are the most common types of pretexting attacks. According to the FTC (Federal Trade Commission), businesses have reported losses of nearly $2.7 billion in the last 2 years. This indicates that the new era of technology is under heavy influence of impersonation attacks. Here are some common ways attacks approach businesses that you should always double-check:

• A business representative for updating account information
• Employee or coworker asking for access to a specific area or connection
• Cryptocurrency exchange platform performing a KYC for security enhancement
• Fake invoice scam for your last shopping 
• IRS and government representatives asking for personal data for scrutiny or taxes
• HR scams with fake job offers that match your interest or niche
• Social scams and romance websites that play with emotional interest and lust
• Scareware scams and account hijack notifications from your bank

Global Laws Against Pretexting

Every sector worldwide has its own set of rules for preventing online scams. Various industries, such as cybersecurity and online banking, have explicit laws against pretexting. For instance, the 1999 Gramm-Leach-Bliley Act strictly instructs financial institutions to avoid obtaining customers’ data under false pretenses. The act criminalizes pretexting while also requiring businesses to train their employees about pretexting detection and prevention. 

Moreover, the 2006 Telephone Records & Privacy Protection Act makes it illegal to access customer data held by telecommunication carriers using pretexts. 

The FTC (Federal Trade Commission) updated its regulations to ban and fine those who use pretexting tactics, such as copying business logos and slogans. Creating a replica of any business website is also a criminal offense. It falls under the spoofing category and can be punished with proper fraud sanctions.

Conclusion

Pretexting is more of a strategy or approach to significant social engineering attacks. It forms the foundation of nearly every online fraud attempt. Some laws and regulations require businesses to report cases of pretexting or impersonation of false authorities or groups. Furthermore, government and legal entities have also made pretexting a criminal offense. According to this law, no one is allowed to use the logos and copyright information of organizations. Despite numerous regulations and online training sessions, pretexting remains a widespread problem. All sectors are affected by pretexting attacks, particularly those companies that do not educate their employees about modern social engineering practices. 

FAQs

What is the impact of Pretexting at an Organizational Level?

Pretexting attacks lead to data breaches and the loss of financial and business assets. They also heavily impact an organization’s credibility and reputation in the business market. 

What are the key aspects of a pretexting attack?

The main principle of pretexting is business research and its structural division. Attackers create a personalized plan to exploit the loopholes in the business structure via social engineering attacks using pretexting. 

What is the history of Pretexting?

Named by the FBI in 1974, pretexting is one of the first examples of social engineering attacks. Moreover, officers use pretexting for their investigations.