Pretexting — the art of creating a believable cover story to get information — has been around for decades. But in 2025, scammers are blending AI, deepfakes, and real-world data to make their lies harder than ever to spot. Here’s what’s changed, and how to protect yourself from these next-generation cons.

If phishing is about tricking you into clicking, pretexting is about tricking you into talking.

Instead of sending a generic scam email, pretexters invent a scenario — the “pretext” — that sounds plausible enough for you to give them the details they want. In the past, this might have been a fake phone call from “IT support” or a courier with a delivery that needed confirmation.

Today? The game has changed.

Criminals have upgraded their stories, added technology into the mix, and learned to make pretexts so convincing that even experienced security professionals have been caught out.

A quick refresher: how pretexting works

The scammer doesn’t just ask for information — they make you want to give it.

The pretexter plays a role, whether that’s a colleague, service provider, or authority figure. They use believable details to gain your trust, then request information or actions that give them access to systems, accounts, or data.

The “success” of pretexting comes down to three things:

1. Believability – The story feels logical and consistent.
2. Confidence – The scammer acts as though they belong in the conversation.
3. Urgency – You feel pressured to respond quickly.

What’s new in 2025

The latest pretexting tricks are far more personalised — and far harder to detect.

1. AI-generated scripts
   Criminals are using AI to write their dialogue, making conversations flow naturally and adapt to your responses. No more awkward phrasing or clumsy requests — these scripts sound professional and polished.
2. Voice cloning
   Using short audio samples (often lifted from social media or video calls), scammers can now sound like your boss, colleague, or even a family member.
3. Deepfake video calls
   Yes, it’s happening. Attackers can now appear on a live video call looking like someone you know, using real-time facial mapping software.
4. Data-driven personalisation
   By scraping LinkedIn, company websites, and public records, scammers can drop in details about your job, recent projects, or even your office layout to make their story more believable.
5. Hybrid attacks
   Online pretexts are being combined with in-person approaches — for example, a phone call from “tech support” followed by a “courier” arriving to collect your laptop for “repairs.”

Examples of next-gen pretexts

Some of these sound far-fetched — until you realise they’ve already been used successfully.

• The “CEO on a flight” scam – A finance team member gets a voice call from their “CEO” (voice-cloned) asking for an urgent wire transfer before boarding a plane.
• The fake vendor security update – An attacker poses as a software vendor rep, citing real system details, and requests temporary login access to “patch a vulnerability.”
• The HR survey trick – Staff receive a link to a “confidential employee satisfaction survey” that asks for personal identifiers and security answers.
• The building maintenance ruse – Someone turns up at reception claiming to be there for scheduled maintenance, using a pretext supported by fake internal emails sent beforehand.

Why they work

Even the most cautious people can fall for these — here’s why.

• They exploit trust in authority – People are less likely to question a senior figure or official-sounding source.
• They mix truth with fiction – Real company details make the story feel authentic.
• They hit you when you’re distracted – Many attacks are timed for busy periods, holidays, or late in the day.
• They create urgency – The less time you have to think, the more likely you are to comply.

How to defend yourself against modern pretexting

Spotting these new tricks takes a sharper approach than the old “look for bad grammar” advice.

1. Verify independently – Always confirm requests through a separate, trusted channel. If “the CEO” calls, call them back on their known number.
2. Slow down – Pretexters thrive on speed. Taking even a minute to think can expose inconsistencies.
3. Ask questions – A legitimate contact should be able to answer follow-up questions without hesitation.
4. Limit public information – The less personal or organisational detail available online, the harder it is for attackers to build a convincing story.
5. Educate your team – Pretexting training should include live role-play or simulations, not just theory.

What organisations should be doing

This isn’t just an individual problem — companies need to adapt too.

• Establish clear verification protocols for financial transactions, account changes, and equipment handovers.
• Run multi-channel phishing tests that include calls, texts, and in-person scenarios.
• Encourage a “challenge culture” where staff feel confident questioning unusual requests, regardless of the source.
• Secure remote communication tools with strong authentication to reduce risk of impersonation.

The bottom line

Pretexting isn’t new, but the 2025 version is a different beast entirely. With AI, deepfakes, and massive amounts of personal data available online, attackers can now create scenarios so believable that even seasoned professionals can be caught off guard.

The key to defence isn’t paranoia — it’s awareness, verification, and slowing down before you act.

Because in the end, the most convincing story in the world still has one weakness: the person hearing it knows how to ask the right questions.