You’ve probably heard of phishing. It’s a form of social engineering that relies on exploiting people’s natural inclination to trust others. Much like phishing, a pretexting scam is designed to fool you into thinking you need to take immediate action and share sensitive information with a scammer.
People are more likely to fall for convincing and thorough scams. Pretexting scams involve researching your business and tailoring communications to you and your employees, so they’re more risky than generic phishing attempts. Verizon estimates that in the last two years, around 25% of financially motivated scams involved pretexting(neues Fenster).
In this article, we’ll explore how pretexting works, how this kind of cybercrime affects businesses, and how to avoid falling prey to it.
What is pretexting?
Phishing and pretexting both rely on bypassing your network by tricking people into letting them in, instead of attempting to penetrate your business network by attacking your cybersecurity. Where phishing casts a wide net with generic communications, pretexting involves researching a specific target.
This type of scam relies on a scammer creating a pretext to ask you to do something for them. Usually the request will be urgent and demand immediate action. The scammer will pose as someone you know, such as a coworker or manager, or someone from a government agency or a business whose services you use. They’ll ask you to quickly take action to make a payment or share information, hoping you won’t check if the request is legitimate.
The urgency of the requests is designed to make recipients act quickly before they can think the action through. Some examples of pretexting scams include:
- An invoice asking you to pay a bill you don’t recognize.
- An email asking you to update your personal details on your company’s HR database.
- A tech support request from a worker asking to gain access to a business service.
- An email or text message that appears to be from someone at your company urgently asking for money.
- A text letting you know your package will be returned if you don’t pay an import fee.
How does pretexting work?
Pretexting is particularly dangerous because it can occur in many different forms. To make a pretexting scam work, a scammer will generally take the following steps:
- Create a character to impersonate. They may decide to pose as an employee using email spoofing, or they may impersonate a business you’ve been connected to. Researching your business helps them create a believable story, and they’ll try to learn as many details as possible to be convincing.
- Decide on a pretext that will make their request seem natural. For example, at the end of a tax year, a scammer may contact your business posing as a tax accountant looking for detailed financial information.
- Once they’ve researched your business and established a trustworthy cover, the scammer will contact you with an urgent request. For example, they may ask you for sensitive business data while posing as a government agent or a coworker. They may also ask for payment for outstanding services or ask you to download software that’s actually malware(neues Fenster).
- After they’ve extracted information such as business logins or financial information, the scammer can infiltrate your network, commit identity fraud, or make financial transactions.
What are the consequences of pretexting scams?
Cybercriminals use pretexting scams to gain access to sensitive data, steal money, and commit identity fraud. If businesses fall victim to scams like this, it can be catastrophic.
Data breaches
If a scammer gains access to your business network, they can exploit sensitive data. This can lead to governmental fines due to non-compliance with data regulation laws. It can also lead to loss of reputation and trust, which many smaller businesses will find difficult to recover from.
Identity theft and further scams
Once a scammer has gained personal information, they’re able to impersonate your employees. This opens individuals up to having false accounts created in their names, as well as being financially affected. Scammers will keep using the stolen data to exploit as many services, systems, and people as possible.
Financial losses
One of the greatest threats to a business posed by pretexting scams is the potential financial losses. Between scammers infiltrating bank accounts and draining them and fines for allowing data breaches, a pretexting scam could end a small business. In 2023 alone, the FBI’s Internet Crime Complaint Center (IC3)(neues Fenster) received 21,489 business email compromise (BEC) complaints with adjusted losses over $2.9 billion(neues Fenster).
How to avoid pretexting scams as a business
The best way to prevent pretexting scams is to avoid rushing into action. Always verify the source of a request. If you’ve received an urgent request from a government agency, verify it by contacting the phone number or email address on their official website. If you’ve received a request from a coworker, ask them on the phone or in person if this was them. This type of scam relies on you acting quickly, so always take time to ensure that a request is legitimate. No reasonable person will push you to act if you aren’t comfortable.
Beyond taking extra care to verify requests, here are actions your business can take to avoid being scammed.
Create an incident response plan
We’ve written before about how important a cybersecurity incident response plan is. It doesn’t just help you in the aftermath of an incident, it helps you prevent one occurring in the first place. It will also help you map out all threat vectors within your business network, helping you understand where you’re vulnerable and how your data could be accessed.
Employ two-factor authentication (2FA)
2FA makes it harder for unauthorized individuals to breach your business network. Encouraging employees to use not just a password but also a physical security key or passkey creates an extra layer of protection against cybercriminals. Educating employees about online safety and empowering them with the right tools is one of the most critical parts of the battle against pretexting scams.
Store business data safely with Proton Pass for Business
Passwords and email addresses are sensitive data that require robust protection. Proton Pass for Business is a password manager that’s an ideal, easy-to-use tool when it comes to cybersecurity. It helps employees work more efficiently and more securely. Using a dedicated business password manager makes it easy to set up team policies to prevent data sharing, monitor activity logs for unusual login attempts, and monitor the dark web for any sensitive information. Creating strong cybersecurity measures and ensuring your employees are using secure tools is your best defense against pretexting scams and social engineering.
