Pretexting

td>and other private data. Some of their clients are
No doubt, by now, you’ve been warnedmajor banks and insurance companies. Pretexting
about "phishing". Phishing attempts to stealhas often been the corporate investigative tool of
personal information via faked websites or boguschoice.
"official" communications, designed to lure the userThe most notorious example of this practice
into providing information via web forms. Therecoming to light recently has been the drama
are numerous tools now available to help protectplayed out at Hewlett Packard, where the board
users against phishing, which is a fairly "passive"chairwoman and other HP luminaries hired an
form of social engineering. The recent scandal atinvestigative agency to track the source of leaks
Hewlett Packard brought a more sophisticatedcoming from board meetings. The investigators, in
form of identity theft via social engineering to theturn, engaged in pretexting to attempt to gain
public consciousness: pretexting.phone records on a suspected board member and
According to the Federal Trade Commission,on the journalist(s) who were writing stories
pretexting is the practice of getting your personalbased on the links.
information under false pretenses. Pretexters sellComputer hackers call the use of an assumed
your information to people who may use it to getidentity "social engineering." That's an endearing
credit in your name, steal your assets, or totitle for theft, but the fact is that this type of
investigate or sue you. That information maybehavior has been in the news for some time
include your Social Security Number (SSN),preceding the HP fiasco. Presidential candidate
telephone records and your bank and credit cardWesley Clark had his cell phone records purchased
account numbers.by a blogger, who turned them into a major
Pretexters use a variety of tactics to get yourpolitical story. The HP story has resulted in an
personal information. For example, a pretexterinvestigation by the California Attorney
may call, claim he's from a survey firm, and askGeneral’s office, which says that it
you a few questions. When the pretexter has thecurrently has six "major" pretexting cases under
information he wants, he uses it to call yourinvestigation, all of them corporate in nature.
financial institution. He pretends to be you orHP’s filing with the Security and Exchange
someone with authorized access to your account.Commission regarding this matter states in part
He might claim that he's forgotten his checkbookthat, "The (HP board) Committee was then
and needs information about his account.advised by ... outside counsel that the use of
In this fashion, the pretexter may be able topretexting at the time of the investigation was
obtain personal information about you such asnot generally unlawful (except with respect to
your SSN, bank and credit card account numbers,financial institutions)..."
information in your credit report. Pretexting is theThe Federal Trade Commission’s web site
key to identity theft, which most commonlysection on this issue reads as follows: "Pretexting
results in credit card fraud, bank fraud, loan fraudis the practice of getting your personal
and communications fraud (opening a phoneinformation under false pretenses. Pretexters sell
account fraudulently).your information to people who may use it to get
However pretexting is also alive and well in thecredit in your name, steal your assets, or to
private gumshoe community: investigatorsinvestigate or sue you. Pretexting is against the
ostensibly working quietly but aboveboard forlaw."
legitimate clients. There is a thriving network ofHP’s investigators are currently under
creative con artists who gather phone recordsindictment.