Pretexting and Impersonation
How pretexting works
Pretexting consists of building a believable false story or identity to justify a request that would otherwise raise suspicion: an attacker can pose as technical support who needs to "verify" a password, an external auditor who requires temporary access to a system, or a new coworker from another office asking for help with an urgent task. Unlike mass phishing, it usually requires more preparation on the attacker's part, including real details about the organization or the person being impersonated to sound legitimate. The main defense is to institutionalize verification: no request for access, a password change or sensitive information should be granted just because the person asking "sounds" convincing, but because their identity was confirmed through an independent, already established channel.