Key takeaway
Verify urgent requests through a second, previously known channel. If personal information is exposed, preserve evidence, secure accounts and contact appropriate authorities if there are threats.
Pretexting builds trust through a fabricated story
Pretexting is social engineering in which a fraudster poses as a colleague, IT support, bank or supplier and invents a believable situation. It can be more personalized than a bulk phishing email and may occur by phone, text, email or in person. Public profiles or previously leaked data can make the story convincing. The goal may be a password, payment, personal information, confidential document or system access.
Vishing uses calls and voice messages
Vishing is voice phishing through a call, robocall or voicemail impersonating a bank, government office, utility or support desk. Caller ID can be spoofed; VoIP and synthesized voices can make a call harder to verify by sound alone. Phishing can use several channels: email phishing arrives by email, smishing uses text messages, and vishing uses voice communication. A demand to “protect your account now” or “pay immediately” is no reason to share credentials or remote access.
Verify an unexpected request through an independent channel
Urgency, unsolicited contact, a request for confidential data and pressure to bypass normal approval are warning signs. End the call or pause the reply; use a number from the organization’s official site or directory, not one supplied by the caller. Confirm payments, account changes and remote support through a second employee and an established procedure. If information has already been shared, change the password from a trusted device, revoke active sessions and notify the security team. Do not give a caller passwords or one-time codes, or approve an unexpected MFA prompt. If money has already been sent, contact the organization’s finance owner and the bank through an official channel immediately; changing a password does not reverse a payment.
Doxing publishes personal information without consent
Doxing is collecting and publicly exposing personal or identifying information without consent, often to intimidate, harass or humiliate. Information may be pieced together from social posts and workplace tags, public records and data brokers, reused usernames and past breaches. An IP address may indicate an approximate location or internet provider in some circumstances; it does not by itself identify a home address. Risks include harassment, reputational and financial harm, false emergency reports and physical danger.
Reduce exposure and respond to disclosure
Limit profile visibility and location tags, avoid reusing usernames across services, enable MFA and use strong unique passwords. Check a data broker’s removal or opt-out procedure; search alerts may help, but cannot guarantee that every copy will be found. If information is exposed, report it to the platform, preserve screenshots and timestamps, secure accounts and alert people close to you about impersonation attempts. Contact local law enforcement or emergency services if there are threats or immediate physical danger.