What is pretexting and how is it different from phishing?

Pretexting is social engineering in which an attacker invents a believable identity or scenario, such as an IT help desk worker or a vendor, to get a person to hand over information or take an action. Phishing is the message used to deliver many lures. Pretexting is the story behind them.

How is it different from phishing?

Phishing is defined by delivery: a message with a bad link or file. Pretexting is defined by the cover story. A phishing email can use a pretext ("this is HR, update your direct deposit"), and a pretext can be played over a phone call with no link at all.

MITRE ATT&CK captures the overlap in Phishing for Information (T1598), which has the goal of eliciting information, often credentials, instead of running malicious code. It notes that adversaries may pose as a source with a reason to collect information and may send multiple, seemingly urgent messages. One listed procedure shows a group combining credential phishing and social engineering to capture one-time password codes.

What does a pretext look like?

Constructed example. Someone calls a new employee at 8:40 on a Monday. "Hi, this is Dana from IT. Your account was flagged during onboarding and I need to confirm your identity. You will get a code on your phone, can you read it to me?"

Every part is designed to be believable. The caller has a plausible role, a plausible reason, a time when a new hire is least sure what is normal, and a small request that sounds harmless. The code, of course, is a real login code for an account the attacker is trying to enter at that moment.

What does the law say?

In the US, 15 U.S.C. 6821 prohibits obtaining, or attempting to obtain, customer information of a financial institution relating to another person through a false, fictitious or fraudulent statement to an officer, employee, agent or customer of the institution, or by providing a forged, counterfeit, lost or stolen document. It also prohibits asking someone else to do so. Law enforcement carries an exception. This is the statutory idea of pretexting for financial records. The attacks you face at work are broader than this statute, so treat it as one legal definition, not the full scope. Ask counsel about your situation.

Why do pretexts work on careful people?

They rely on role and routine, not on carelessness. People help colleagues. They defer to authority. They want to avoid causing a problem. CISA's guidance recommends the countermeasure that beats all of this: if something looks suspicious or even might be real, do not use the link or number in the message. Look up another way to contact the company or person, and reach them through that route.

CISA also notes that grammar is no longer a reliable tell, since AI-written messages can be flawless. Judge the request, not the polish.

How to check or apply this

1. Publish a plain rule: IT never asks for a login code, password or approval. Say it at onboarding and repeat it.
2. Give staff a verification path for requests that sound legitimate: call back on a number from the company directory.
3. Mark high-risk requests, such as payment changes, password resets and access grants, as needing a second person or a second channel.
4. Make it safe to say no. Praise the person who stopped a real attempt, even a failed one.
5. Protect the help desk: require identity checks that cannot be answered from public profiles.
6. Rehearse. Run a phone-based tabletop where someone plays the caller.
7. Prefer sign-in methods that cannot be talked out of a user, since a code read aloud is a code stolen.

Quick check

Sources

• MITRE ATT&CK: Phishing for Information, T1598
• 15 U.S.C. 6821, Privacy protection for customer information of financial institutions
• CISA: Recognize and Report Phishing

Last reviewed: 18 October 2026.