Real pretexting cases from this library, from the HP boardroom scandal to the Clorox help-desk breach, with the story each attacker told and the check that would have stopped it.
Pretexting is a social engineering attack where someone makes up an identity and a reason, the pretext, so you'll hand over information, access or money. The story does the work: a colleague who's locked out, a fraud officer from your bank, the power company about to cut you off. No malware is involved. The target simply acts on a request that seems legitimate.
Key takeaways
Three real pretexting attacks
The pretext changes and so does the target. The steps mostly don't. Across the cases here, there are five.
If the first contact is a phone call, the delivery method is vishing. If the target is an IT support line, it overlaps with help-desk and MFA manipulation.
The caller is an employee who needs a password or MFA reset, or IT staff who need your help. At Clorox, one caller impersonated two employees, and one of them was on the IT security team.
"This is your bank. There's fraud on your account and you need to move the money now." iSpoof sold the spoofed numbers and code-interception tools that made calls like that look genuine.
Here the story leans on someone with power over you, like an official or the power company. PG&E customers heard their power would be shut off unless they paid at a store, using a barcode sent by text or email.
A "grandchild" in trouble calls, then passes the phone to a fake lawyer or police officer. The Dominican Republic grandparent ring allegedly had openers, closers and couriers who collected cash in person.
The attacker pretends to be a customer and asks the company holding the records to release them. In the HP boardroom case, data brokers posed as directors and journalists and got their call logs from carriers.
Someone uses a real person's identity to get through hiring checks. In the North Korean laptop-farm case, workers used stolen American identities to hold remote jobs at more than 100 U.S. firms.
The target doesn't have to be a person. In a reported breach of Mexican government agencies, an operator told an AI coding agent the job was an authorized bug bounty. This is a reported, alleged incident.
Each row is a case in this library, grouped by who the attacker claimed to be. Loss figures keep the basis given on each case page, so don't add them up.
| Claimed to be | Case and year | Who was targeted | Loss or impact |
|---|---|---|---|
| An employee locked out | Clorox, 2023 | An outsourced IT service desk | About $380 million claimed in court, plus weeks of disruption |
| A fellow employee | Novell, 1993 to 1994 | A support analyst | NetWare source code stolen |
| The bank's fraud team | Phantom hacker scam, 2024 | A bank customer in Chicago | $20,000 wired |
| Bank or government staff | iSpoof, 2020 to 2022 | Bank customers in the UK and abroad | £43 million in UK frauds identified, about £100 million estimated worldwide |
| The power company | PG&E, 2025 to 2026 | Households and small businesses | Over $211,000 reported through mid-2026, across all PG&E scams |
| A government official | Costa Rica sweepstakes call center, 2014 to 2017 | Mostly elderly U.S. residents | Over $4 million |
| Grandchild, then lawyer or police | Dominican Republic ring, 2019 to 2023 | Elderly Americans | Millions of dollars, as alleged in the indictment |
| An insurance rep | New Jersey widows scheme, 2020 to 2021 | Recently widowed older adults | Over $100,000 in prepaid gift cards |
| Board members and journalists | Hewlett-Packard, 2005 to 2006 | Phone carriers holding directors' and journalists' records | A congressional hearing and a new federal law |
| Not disclosed (imposter scam) | SCI Engineered Materials, 2026 | A public manufacturer in Ohio | $898,325 lost, $336,299 recovered |
All 10 are documented incidents. The full list of 22 is further down this page, with filters for status and country.
Here's the Clorox service-desk call, broken down. It's based on Clorox's complaint, so these details are Clorox's allegations.
| What the caller did | Red flag | Why it matters |
|---|---|---|
| Said they had no password and couldn't connect | They wanted a credential | A password is the most valuable thing a service desk can give out |
| Added, "My Microsoft MFA isn't working" | A second-factor reset right after a password reset | Both factors in one call is a full account takeover |
| Called back twice that day as the same employee | Repeat resets on one account | Real users almost never need three resets in a few hours |
| Asked to change the phone number for SMS codes | Codes going somewhere new | It hands the second factor to the attacker |
| Was never asked to prove who they were | The written check got skipped | The story only had to sound plausible. Nobody asked for proof. |
| Stage | Defense | Case it would have broken |
|---|---|---|
| Reconnaissance | Assume attackers already know names, roles and vendors, and use checks public data can't pass | HP, Clorox |
| Pretext | Publish plain "we never" rules, like never taking payment by barcode or gift card | PG&E, New Jersey widows scheme |
| Initial contact | Don't trust caller ID. Hang up and call a number you looked up yourself | iSpoof, phantom hacker scam |
| Verification | Call back a number on file, get a manager to confirm, or use a self-service reset tool | Clorox, Novell |
| Action | Have a second person approve resets, record releases and big payments | Clorox, HP |
| Cash-out | Train bank and store staff to question gift-card, barcode and "safe account" payments | PG&E, phantom hacker scam |
The pretext is the story. Phishing and vishing are how it gets delivered. Phishing sends the lure by email or message, usually to lots of people at once, and usually wants a click. Vishing does it by phone.
Either channel can carry a pretext. The Clorox caller used a phone call to deliver an IT-lockout story, and HP's investigators called the carriers. Most phishing emails have a thin story, like "your account is locked." A real pretexting attack puts effort into a believable identity and often plays out over several conversations. There's a side-by-side comparison in phishing vs pretexting.
In the United States, the HP case changed things. Congress passed the Telephone Records and Privacy Protection Act of 2006, signed on January 12, 2007. It made getting phone records by pretexting a federal crime under 18 U.S.C. Section 1039.
The first charges under that law came in late 2008. Nicholas Shaun Bunch and Vaden Anderson were accused, in separate cases, of tricking T-Mobile and Sprint/Nextel into releasing customers' call records. Meanwhile the FTC brought six civil cases against 16 data brokers and private investigators between 2006 and 2008.
Outside phone records, these schemes are usually charged as fraud. The Dominican Republic ring was indicted for mail and wire fraud conspiracy, and the Costa Rica call center's ringleader was convicted at trial.
Often, yes. In the U.S., getting someone's phone records this way has been a federal crime since January 2007, under 18 U.S.C. Section 1039. Other versions tend to be charged as fraud, like the mail and wire fraud conspiracy count against the Dominican Republic ring. Penetration testers use pretexts legally, but only with permission from the organization they're testing.
The 2023 Clorox breach is one of the clearest. According to Clorox's lawsuit, a caller posing as a locked-out employee got the outsourced service desk to read out a new password and reset MFA, without any identity checks. The caller did it again as someone on the IT security team, and that opened the network to weeks of disruption.
Close, but not quite. Impersonation is the fake identity, a bank officer or a colleague, say. The pretext is the whole story that gives that person a reason to ask for something right now. This library groups the two together because almost every case here depends on pretending to be someone the target trusts.
Pretexting asks for something under a false identity. Baiting puts out something tempting and waits for the victim to use it. The classic bait is an infected USB drive. In Operation Buckshot Yankee, one infected drive let a worm onto U.S. military networks. With baiting there's usually no conversation and no made-up identity to check.
Yes, two ways. AI can make the story more convincing, for example with voice cloning. And attackers can aim the story at the AI itself. In the reported Mexican government breach, an operator convinced an AI coding agent it was working on an authorized bug bounty. That one is a reported, alleged incident.
Counts on this page come from the 22 cases tagged pretexting and impersonation in this library on 20 Oct 2026. The library statistics page has the wider picture. Reviewed by SEE Team. Last reviewed 20 Oct 2026. See the methodology, or who publishes this library.
In the PG&E scam, a caller claiming to be from the utility threatens to cut the power today. Then a barcode or QR code arrives by text or email, with orders to pay it at a store checkout. By the middle of 2026, PG&E customers had reported more than $211,000 in losses, and the company suspects the barcode trick is part of why.
PAA Chicago hairstylist lost $20,000 to a Phantom Hacker scam. A caller claiming to be Bank of America said a hacker was draining her account, so she wired her own money to the scammers. His number matched the one on the back of her card. ABC7 Chicago reported the case in January 2025 under the FBI's "Phantom Hacker" label. The $20,000 is her own figure, and none of it has come back.
PAAn Atlantic City woman called grieving widows posing as a life insurer, demanding gift cards to clear policy "arrears". 17+ victims, $100,000+. How it worked.
PAThe HP spying scandal began with a hunt for a boardroom leaker. Hewlett-Packard's investigators hired contractors who posed as directors and journalists to get their phone records from carriers. When it came out in 2006, it cost HP a $14.5M civil settlement with California. Then came a congressional hearing, felony charges against five people (chairwoman Patricia Dunn among them), and federal guilty pleas from three contractors.
PAiSpoof was a UK-run, Bitcoin-paid website that let fraudsters display a real bank's number and capture the codes victims keyed in. In the UK alone, prosecutors traced £43 million in fraud to the site. The judge put the worldwide figure nearer £100 million. Police took the server down on November 8, 2022. Six months later its administrator, Tejay Fletcher, got 13 years and 4 months.
PAProsecutors say a grandparent scam run from call centers in the Dominican Republic hit hundreds of elderly Americans and took millions of dollars. One caller played a grandchild under arrest. Then a fake lawyer, police officer, or court clerk took over, and couriers in the US picked up the cash. Sixteen people were charged in 2024. Nothing's been proven in court, and there's no itemized loss total anywhere.
PAIn August 2023, Clorox says, someone phoned its outsourced Cognizant help desk pretending to be two different employees. Agents reset their passwords and MFA, phone number for SMS codes included, without checking who was calling. Operations were disrupted for weeks. Clorox wants $380 million from Cognizant. That's a claim, not a proven loss, and a March 25, 2026 ruling let three of its four claims go ahead.
PA
Social Engineering Examples