| name | conducting-social-engineering-pretext-call |
| description | Plan and execute authorized vishing (voice phishing) pretext calls to assess employee susceptibility to social engineering and evaluate security awareness controls. |
| domain | cybersecurity |
| subdomain | red-teaming |
| tags | ["social-engineering","vishing","pretext-call","security-awareness","red-team","phishing","human-risk"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| atlas_techniques | ["AML.T0088","AML.T0052"] |
| nist_ai_rmf | ["GOVERN-6.2","MAP-5.2"] |
| d3fend_techniques | ["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"] |
| nist_csf | ["ID.RA-01","GV.OV-02","DE.AE-07"] |
Conducting Social Engineering Pretext Call
Overview
A pretext call (vishing) is a social engineering technique where an attacker impersonates a trusted authority figure over the phone to manipulate targets into divulging sensitive information, performing actions, or granting access. In red team engagements, pretext calls test the human element of security controls, measuring employee adherence to verification procedures and security awareness training effectiveness. MITRE ATT&CK maps this to T1566.004 (Phishing for Information: Voice) and T1598 (Phishing for Information).
When to Use
- When conducting security assessments that involve conducting social engineering pretext call
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Most Often Missed & How to Confirm
- Calling without a verifiable callback story. When the target offers to call back, you need a real-sounding internal number/ticket ID prepared or the pretext collapses. Stage this before dialing.
- Mismatched caller ID and pretext. Spoofing an external number while claiming to be internal IT is an instant tell. Align the spoofed CLID with the claimed department.
- Skipping OSINT-grounded specifics. Real dept names, the actual VPN vendor, and a current event (migration, merger) are what make the pretext land — generic scripts fail.
- No graceful exit. Operators fail to disengage cleanly when pushed, leaving suspicion that gets the whole campaign reported.
- Not recording verification behavior, which is the most valuable awareness metric.
- How to confirm a hit: the concrete success signal is the target disclosing the requested item (credential, MFA code, employee ID) or performing the requested action (installing remote-access tooling) on the recorded line. Log per call: info obtained, whether verification was attempted, and whether it was reported to security. Don't score a call as a "pass" for the defender until you've confirmed the target actually verified your identity or reported the call — silence is not a pass.
Prerequisites
- Written authorization specifying social engineering scope and boundaries
- List of approved target employees (usually provided by client)
- OSINT research on targets and organization
- Spoofed caller ID capability (authorized for testing)
- Call recording equipment (with legal consent as required)
- Pretext scenarios approved by client
MITRE ATT&CK Mapping
