Pretexting is one of the most prevalent methods employed by cybercriminals, despite the fact that you may not frequently hear the phrase.
The strategy is crucial to phishing fraud. These attacks, in which malicious messages are conveyed to unsuspecting victims, are a widespread hazard. Phishing accounts for 90% of all data breaches, according to CISCO's 2021 Cybersecurity Threat Report.
What exactly is a pretexting attack?
The underlying framework of social engineering tactics is pretexting. Meanwhile, social engineering is the process through which fraudsters persuade people into undertaking specific acts.
In the context of information security, this typically takes the form of phishing scams, which are messages from a purportedly legitimate sender asking the receiver to download an attachment or click a link that brings them to a fraudulent website.
Social engineering can also be used to induce various types of data breaches. A fraudster, for example, might access an organization's grounds posing as a delivery person, and then slip into a secure area of the property.
All of these social engineering techniques have one thing in common: the attacker's request appears to be legitimate. In other words, they have the pretext to contact people - therefore 'pretexting'. Because gaining the victim's confidence is vital to the attack's success, the attacker will conduct research on their target and fabricate a plausible narrative to increase their credibility.
Modus operandi
In pretexting scams, the fraudster establishes a relationship with the victim in order to earn their trust.
Consider the following scenario: your company's financial assistant receives a phone call from someone pretending to be from a current supplier. The finance assistant delivers all the details the caller requires after a series of phone calls in which the caller describes the need to verify financial information as part of a new process.
In this case, the caller developed a friendship with the victim and used a convincing tale to deceive the target into disclosing the information.
In other instances, building the target's confidence over time is unnecessary. This is frequently the case if the attacker has compromised or is spoofing a senior employee's account. The prospect of an urgent message from a director is frequently sufficient to ensure that the employee complies with the request.
Prevention tips
Avoiding interactions with messages from unknown or dubious senders is the most efficient strategy to protect yourself and your organization from scammers.
The goal of scammers is to deceive individuals into clicking on links or downloading contaminated attachments. Any communication requesting you to do one of these things should be approached with extreme caution.
If you're ever unsure whether a message is real, seek secure ways to confirm it. If you receive a request from an employee, for example, speak with them in person, by phone, or over an instant messaging application.
Although you may be hesitant to do this for a senior employee, especially if their message indicates that the request is urgent or that they will be in meetings all day, it is better to be safe than sorry.
Your organization's information security policy should include instructions similar to this to ensure that you are adhering to best practices. This guidance should be reinforced in any information security worker awareness training you receive.