Blagging (pretexting)

Computer Science · Social engineering

Take the call: where does it end?

Start at the call, then pick a branch at each fork to see where this call ends.

Identity check → Disclosure policy → Access

On The call: “Hi, IT support here. Your account's been flagged and I need your password right now.”. 2 branches to choose from.

You're the employee who picks up the phone. At each fork, choose what happens and watch the route change.

Take the story apart

What is each line doing?

Someone phones claiming to be from your bank. For each line, pick the job it is doing in the blag.

6 of 6 still to sort.

Here's one invented call, cut into lines. Decide what job each line does for the attacker.

What you need to know

• Social engineering means tricking people, not machines, into giving up confidential information or access.
• Blagging, also called pretexting, is social engineering using a believable invented story: the pretext.
• Have a goYour mate says: “Blagging is basically hacking, just with a phone.” They sound very sure. What have they missed?

  Blagging targets a person with an invented story. It doesn't break the computer's defences.

  Social engineering manipulates people rather than breaking technical defences, so the person is the target, not the technology.

• The blagger usually pretends to be someone you'd trust or obey, like a colleague, manager, tech support or a bank employee.
• Blaggers often gather background details first, then add urgency or authority so the victim doesn't stop to check.
• It works because people want to help and trust a legitimate-looking request, so it can bypass technical security.
• Have a goA company has an excellent password system. Can a blagger still get past it? Answer in one line.

  Yes. They persuade a person to reveal the password, so the system is never attacked.

  Blagging targets the person, so a strong password is useless if someone is talked into giving it away.

• A successful blag can lead to data disclosure, unauthorised access, identity theft and financial loss.
• Defence one: verify who's asking through a separate trusted channel, such as calling back on a known number.
• Have a goA caller says: “Don't bother ringing back, there's no time!” What should that make you more or less likely to do?

  More likely to check, using a number you already know.

  Urgency is often added so the victim doesn't stop to check, and a callback on a known number tests the story.

• Defence two: a policy that staff never disclose passwords or sensitive data on request.
• Training helps people recognise pretexts and pressure tactics.
• Limiting what each person can access means one deceived person reveals less.

The big picture

Blagging (pretexting) is social engineering: the attacker invents a believable story to talk a person into handing over information or access, so technical security can be bypassed. Checking identity through a separate trusted channel, no-disclosure policies, staff training and limited access stop a blag or limit the damage.

⚠ Watch out

Treating a callback as optional because the caller sounds convincing or in a hurry. Pressure not to check is exactly what a pretext often adds, so the check matters most then.

Memory hook

A blagger doesn't pick the lock. They talk someone into opening the door.

Check yourself

Cover the page. A caller says they're from IT support, it's urgent, and they need your password. Say what makes this a blag, and name one thing that would stop it.