Phishing vs pretexting: think message versus backstory. A phishing email is the thing that lands in your inbox and nudges you to click. The pretext is the yarn behind any request. Who the person claims to be, and why on earth they need your help right now.
Most phishing emails carry a small pretext (“your account is locked”). But pretexting doesn’t need email at all. Some of the best-known cases happened entirely over the phone.
| Phishing | Pretexting | |
|---|---|---|
| What it is | A deceptive message sent to get an action | A false identity and reason, built to make a request believable |
| Channel | Mostly email, also texts and chat | Phone, email, video, in person, anything |
| How much setup | Often little; the same email goes to many people | Usually more: research first, then a story that fits the target |
| Typical ask | Click, log in, open a file | Reset this account, share these records, approve this exception |
| A case from this library | Target (2013): an email to a contractor | HP (2006): investigators posing as directors to get phone records |
Key takeaways
People tend to file these as rival categories. They aren’t. How did the message get here? Maybe phishing. Why did someone in accounts go along with it? Nearly always a pretext.
Good pretexts get built first. Locked-out employee. Supplier with new bank details. Executive about to board a plane. Only once the role feels real does the ask arrive, and by then it slots neatly into a story the target already believes.
Hunting for a board member who was leaking to the press, Hewlett-Packard’s investigators hired contractors who called phone carriers pretending to be directors and journalists, and got their call records. The carriers handed over records to anyone who could give all or part of the subscriber’s Social Security number. HP paid a $14.5 million civil settlement with California, and three contractors pleaded guilty federally. Full case: HP spying scandal.
Mitnick posed as a real Novell employee who was on vacation, claiming he urgently needed access for an internal project. He got around a voicemail-based identity check by taking over that employee’s voicemail first, and talked his way into a dial-in account used to steal NetWare source code. Full case: Mitnick and Novell.
According to Clorox, a caller pretending to be employees got its outsourced Cognizant help desk to reset passwords and MFA without proper identity checks. Clorox is seeking $380 million from Cognizant, but that’s a legal claim, not a proven loss. Its SEC filings put gross incremental costs at roughly $59 million. Full case: Clorox help-desk vishing.
Target, 2013. A small HVAC contractor got an email carrying malware, and there was barely any story to it. The email just had to get opened, and the malware did the rest, stealing the contractor’s login to Target’s vendor systems. Target’s Form 10-K for fiscal 2016 put the total cost at $292 million, or $202 million after insurance. Full case: Target vendor phishing breach.
Tip: when a request comes with a good reason attached, check the reason, not just the person. “I’m locked out and presenting to the board in ten minutes” is exactly the kind of story a pretext is made of.
Browse the pretexting cases and the phishing cases.
Not quite. Lots of phishing emails carry a little pretext, sure. But pretexting turns up on phone calls, video calls and at the front desk too, with no phishing anywhere near it.
A caller saying they’re an employee who’s locked out and needs a password reset right now. That’s the pattern in the Clorox case, and in the HP case investigators pretended to be account holders to get phone records.
Often, depending on what’s obtained and where. US federal law now makes phone-record pretexting a specific crime, and using a false identity to obtain money or data is fraud in most countries. This isn’t legal advice, so check the rules where you are.
Because a good pretext gives the target a reason to help. The attacker is polite, informed and slightly rushed, which is how real colleagues sound on a bad day. That’s why the fix is a process step, not a gut feeling.
Reviewed by the SEE Team on 22 October 2026; every case linked here has its sources on its own page. How pages are researched and fact-checked. About Social Engineering Examples.
Social Engineering Examples