Pretexting Samples
8.4 Pretexting Samples
As described in the introduction (to this section) price, pretexting is putting someone in a familiar situation to get them to divulge information. Let us see some examples in the next slides.
8.4.1 Sample
Let’s say we want to target someone in the general area of an outage that will affect them. If we go to Google and run a search, like the one showed in the next screenshot, we will get outages posted on different websites.
Once opened, we see that there will be power outages in specific areas.
Knowing this, we can open Google Maps and take a look at the area, the address and eventually find the owner of one of the locations. So, in 15 minutes or less, we will have enough information to construct our pretexting attack. So, let us create our script.
The following is an example of what our conversation may look like:
So, in a relatively short amount of time, we have constructed a believable story and found a suitable victim. So what did or did not we get? Well, note that we did not ask for the full Social Security Number, but we did get the last 6 numbers, plus the state in which the person was born.
Every state has a set of prefixes, that is used for Social Security Numbers. Now, all we have to do is reference that list and we will obtain the full SSN! Here is a list. As you can see, a little bit of internet searching and some creative thinking, is all we need to try and find unwitting victims.
Now keep in mind that this is illegal since the adoption of the Gramm-Leach-Bliley Act of 1999, which makes it illegal to: • Use false, fictitious or fraudulent statements or documents to get customer information from a financial institution.
Governments are familiar with these scams, but it is not always easy to find and prosecute scammers. Therefore, we have to rely on the victim education, to ensure that they are not taken advantage of in these types of scenarios.
Last updated