Pretexting is a social engineering attack that works by inventing a believable scenario — a pretext — and using it to talk an employee into handing over information, a payment or access. The fake invoice from a real supplier, the “HR system update” that collects staff logins, the caller who knows your CEO is travelling and needs “an urgent payment processed”: the technique never changes, only the costume. It is the engine behind the most expensive attacks on Australian businesses — payment redirection and business email compromise made up 15% of business cybercrime reports to ASD's ACSC in FY2024–25 (ASD Annual Cyber Threat Report 2024–25) — and it is the attack your email filter is least equipped to stop.
TL;DR
- Pretexting is social engineering built on an invented scenario: the attacker manufactures a reason for you to act, then exploits your willingness to help.
- It arrives by email, phone, SMS and even in person — often with no link or attachment for a filter to catch.
- The Australian loss leader is payment redirection: invoices with “updated bank details”, backed by a supplier's real name and a real-looking thread.
- The defence is verification procedure, not detection software: confirm every request through a channel you already hold.
- Monthly training and simulations rehearse the exact pretexts your industry receives — the reflex beats the scam.
What is pretexting?
A pretext is a lie with logistics. Instead of asking for something valuable outright, the attacker builds a story that makes the request feel routine:
- Authority: “I'm the CFO, I'm boarding a flight, I need this paid before takeoff.”
- Familiarity: a reply inside a real email thread, or a first name and a shared project reference.
- Urgency: a deadline, a final notice, a system outage that expires in an hour.
- Helpfulness: “I'm from IT, I just need to verify your account — can you read out the code I just sent?”
Each element does one job: it shortens the time between the request and the action, because verification is what kills the scam. An employee who checks — calls the supplier on the number on file, walks over to the “CFO's” desk — defeats the pretext in ten seconds. The whole craft is preventing that check.
How a pretexting attack unfolds
- Research. Public sources do most of the work: company websites, LinkedIn, ASIC registers, job ads, and any previous breach. The attacker learns who pays invoices, which suppliers you use, when payroll runs and who is on leave.
- The setup. They establish the scenario — often days ahead. A harmless email to establish rapport. A compromised supplier mailbox. A phone call to confirm “you're still the right person for accounts?”
- The ask. The pretext matures into a request: changed bank details, an urgent transfer, a login on a fake portal, staff data “for the new HR system”.
- The pressure. If the target hesitates, urgency and authority escalate: “the auditor needs it today”, “the account will be suspended”.
- The exit. Once the payment lands or the credential is used, the attacker moves on — mule accounts are emptied within hours, so recovery depends on how fast the fraud was noticed.
Pretexting vs phishing vs business email compromise
| Pretexting | Mass phishing | BEC | |
|---|---|---|---|
| What it is | An invented scenario that justifies the ask | A bulk lure — prize, invoice, urgent notice | Fraud via a real or lookalike business mailbox |
| Volume | One target at a time | Thousands | A handful of targets |
| Research | High — the pretext is built on real detail | None | High |
| Channel | Email, phone, SMS, in person | Mostly email | Email, sometimes phone |
| Filter catches it? | Rarely — often plain text | Usually | Rarely |
The categories overlap in practice: BEC is the most profitable pretexting outcome, and whaling is pretexting aimed at executives. What they share is the human layer — which is why the defence is the same.
The pretexts Australian businesses actually face
- Supplier bank-detail changes. The single most expensive pretext. A real supplier's name, a plausible reason (“we've changed banks”), a deadline. The defence is one rule: payment details change only after a phone call on a number already held.
- Executive requests. Gift cards, urgent confidential payments, payroll changes “before HR closes the pay run”. See whaling for the executive-impersonation variant.
- IT and help-desk resets. “I've locked myself out, can you reset my MFA?” — aimed at your real help desk, using a real employee's name. Help-desk identity checks are part of the same verification discipline.
- HR and payroll forms. A fake portal collecting logins or identity documents from new starters, who have no baseline for “normal” yet.
- Government impersonation. Fake ATO debts, ASIC renewal notices, myGov suspensions — the lures Scamwatch catalogs every week.
Training staff against pretexting
Because the attack targets judgement rather than software, training is the control — and it works on cadence, not memos:
- Teach the shape, not a list of examples. Authority, urgency, secrecy, an unusual channel: when two or more appear together, verification is mandatory. A trained shape outlasts any specific scam wave.
- Rehearse your industry's pretexts. Generic examples slide off; the fake supplier email that matches a real supplier does not. Cyber Aware's security awareness training runs monthly, story-driven modules built on the lures Australian staff actually receive.
- Simulate the exact ask. Phishing simulations that rehearse invoice fraud and payment redirection turn policy into reflex — anyone who clicks lands in a coaching module the same day, not in trouble.
- Make reporting the win. A suspicious request reported in minutes protects every other mailbox. Blame-free reporting is what keeps the flow of warnings alive.
- Measure per person and act on the trend. Human risk reporting shows who is improving and who needs coaching, so follow-up lands on the right desks.
- Back it with process. Dual approval for payments above a threshold, out-of-band verification for any detail change, and help-desk identity checks. Process carries what memory forgets.
If you are unsure where your exposure is thickest — people, process or tooling — a security gap assessment ranks it in an afternoon, and the platform comparison shows which training provider fits the cadence.
What to do if a pretext already worked
If money moved: call your bank immediately on the number printed on your card, then report to ReportCyber. If credentials were handed over: reset the password, revoke sessions, and check mailbox rules — then report internally so the team is warned. Either way, preserve the messages; they are evidence and they are tomorrow's training material.
FAQ
What is pretexting in simple terms? A scam built on an invented scenario. The attacker creates a believable reason — an invoice, an executive request, an IT check — that makes you hand over money, information or access without verifying.
Is pretexting illegal in Australia? Yes — the behaviour typically involves fraud, and impersonating a Commonwealth entity carries specific offences. Victims should report incidents to ReportCyber and Scamwatch.
How is pretexting different from phishing? Phishing is the delivery method (usually a bulk email); pretexting is the manipulation technique — a researched scenario that can arrive by email, phone, SMS or in person, often with nothing technical for a filter to detect.
Can security software stop pretexting? Rarely. The attack is often plain text from a real or lookalike identity, with no link or attachment. Verification procedure and trained staff are the controls that hold.
What is the strongest anti-pretexting rule? Out-of-band verification: any request that moves money or data is confirmed through a channel you already hold — a phone number on file, a walk to the person's desk — never through contact details the request itself supplies.
One last thing
Pretexting does not hack systems; it hires your staff, briefly, as unwitting insiders. Every verification habit you train — the callback, the dual approval, the reported odd email — raises the cost of the con until the attacker moves on to an easier target.