Pretexting is a social engineering technique in which an attacker invents a plausible scenario to manipulate a target into disclosing information or performing an action. section 11.2.2
Fabricated IT password reset
An attacker may call an employee while claiming to be from the IT department, request a password reset, and direct the employee to a fraudulent login URL. Because the request uses a fabricated identity and scenario, it is pretexting; because it occurs by phone, it is also vishing. section 11.2.2
Pretexting belongs to a broader set of attacks that exploit human behavior:
- Phishing, spear phishing, whaling, smishing, and vishing use deceptive messages or calls to obtain information or trigger actions. section 11.2.2
- Attackers may exploit authority, liking, reciprocity, commitment, or urgency to increase compliance. section 11.2.2
- Tailgating or piggybacking applies similar social manipulation to physical entry into restricted areas. section 11.2.2
