Trust is the payload

A pretext is a fabricated identity or scenario. IT calling to fix an issue, a vendor who needs a door held, a CFO who wants a quiet wire. The attacker researched the name, the manager, the ticket queue, sometimes the voice.

Unlike a phishing mail, this is interactive. The caller answers hesitation, adds a little time pressure, and asks for the smallest foothold: an MFA reset, a shared file, a badge swipe. People who would never click a link still help a colleague on the phone.

• Known details, unknown channel They know your name and team, but they called you. That is research, not proof.

• Access, codes, or money Credentials, MFA, a door, a wire. The request is always a foothold.

• Keep this quiet Confidentiality that blocks a second approver is part of the story.

• Voice that is almost right Even pacing, odd artifacts, or a boss who would not usually call you this way.