What’s being sold isn’t a lie, but a role
A phishing email plays the numbers game: it gets sent to thousands, and someone will click. Pretexting works differently - a story is built around you. The name of your department, the bank you actually use, the order you really are waiting for. None of this is secret information: it’s on social media, in data leaks, or in your own email signature.
The point of the details is not to prove anything. They remove the question, “Who even is this?” While you check one detail and it matches, you stop checking the rest - your brain fills in the whole role. One matching little detail acts as a guarantee for the whole story.
The cover story. They prepare a role and a reason in advance: a login check, a delivery, an error in the documents. The reason explains why they’re calling you specifically, and why now.
A small truth. In the first few seconds, they mention something that really is known about you. It’s not a request, but a down payment on trust.
Urgency. A window appears: “the request is pending for 10 minutes.” There is no time to check by design, not by accident.
Isolation. They ask you not to hang up, not to discuss it, or to move to a messenger app. Any third person can break the script.
A small request. First, they ask for something minor - to confirm, dictate, or tap. Once you agree once, it’s harder to refuse the second time.
What it sounds like
The conversation almost always goes one way: the other person asks questions, and you answer. They’re checking you, even though they called you. Here’s a typical exchange - look not at the words, but at how the role shifts.
This is security. I can see an attempt to log in to your account from another city.
I haven’t logged in anywhere.
That’s what I thought. I can still send the blocking request, but the window is 10 minutes.
What do I need to do?
Read me the code from the message - it will confirm I’m speaking to the account owner.
Okay, one second.
There are three markers in a row here. You were given alarming news that you can’t verify. You were given a deadline. And you’re being asked to prove that you are you, even though you didn’t initiate the call. The code in the message confirms nothing to the other person: it is needed precisely to log in, and real support will not ask for it.
Notice who is in a hurry here, too. In this kind of conversation, the urgency always belongs to someone else: it was brought to you. Remove the timer, and the script falls apart, which is why they keep it in place.
The script doesn’t rely on naivety, but on normal reactions: helping, not arguing, and resolving an issue quickly. That’s why it most often catches busy, polite people.
Why do pretexters mention a small true detail about you?
What helps if you’re rushed and asked for a code from a message?
Sources
- Influence mechanisms - based on Robert Cialdini’s work on authority, scarcity, and consistency
- pretexting analysis - Kevin Mitnick, “The Art of Deception”
- warning signs - in public guidance from banks and CERT
Next in the “Social Engineering” series
3 articles in full on the site, 4 more in the app
