Pretexting is creating a false scenario to gain trust and extract information.
Pretexting involves building a convincing false identity or scenario before making contact. A well-prepared attacker does reconnaissance first: they check LinkedIn for your job title, your company's website for IT team names, and social media for details that make their story plausible.
Common pretexts include: an IT helpdesk agent who needs your credentials to "reset your account," a bank employee calling to "verify" a suspicious transaction (requiring your full card number), and a delivery company confirming your address for a package that requires a signature.
Caller ID cannot be trusted. Attackers use spoofing tools to make any number appear on your screen — including your bank's official number. If someone calls you about security or account issues, hang up and call back using the number printed on your card or the organization's official website.
Attackers specifically target emotions during vishing calls — creating urgency, concern, or gratitude to push you past the point of skepticism. If you feel pressured on a call, that pressure is the attack mechanism. Slow down, ask for their name and employee ID, and call back independently.