Social engineering: blagging (pretexting)

The idea

Blagging, also called pretexting, is a social engineering technique in which the attacker invents a believable story or false identity, the pretext, to persuade someone to hand over information or access. The attacker might pose as an IT technician, a supplier or a senior manager and give a plausible reason for needing a password or file. The victim complies because the story sounds legitimate and the request appears to come from someone with authority or a genuine need. The attacker gains credentials, personal data or system access. To explain blagging, state the invented pretext, the trust or authority it exploits and the information or access obtained. It differs from simply guessing because the attacker manipulates a person's willingness to believe a fabricated scenario.

What earns the marks

• Defines blagging (pretexting) as inventing a false story or identity to obtain information or access.
• Describes the pretext, for example posing as an IT technician, supplier or senior manager with a plausible reason.
• Explains why the victim complies, such as trusting the apparent authority or believing the story is genuine.
• States what the attacker gains, such as passwords, personal data or access to a system.
• Distinguishes blagging from technical attacks by identifying that a person is manipulated through a fabricated scenario.

Common mistakes and how to put them right

• Treating blagging as a technical hack.

  Put it right: It is a social engineering technique that manipulates a person with a false story.

• Giving no pretext; correction: describe the invented identity or reason that makes the request believable.

• Confusing blagging with phishing emails alone.

  Put it right: Blagging is the fabricated pretext, which can be delivered by phone, email or in person.

Exam tips

• Name the false identity or story the attacker uses, then explain why it is convincing.
• State clearly what the attacker obtains as a result of the deception.
• Use the term pretext to show you understand the mechanism, not just the label.