Pretexting is a form of social engineering in which someone invents a false scenario, or “pretext,” to trick you into handing over personal information such as account numbers, passwords, or your Social Security number. The pretexter usually poses as someone you’d trust or fear: your bank’s fraud department, a tax agent, a tech support worker, a supervisor, even a family member. Federal law takes it seriously enough that obtaining financial records through a fabricated story can carry up to ten years in prison under aggravated circumstances.
How Pretexting Usually Looks
The classic version is a phone call or email from someone claiming to represent your bank. The caller already knows a few details about you, often pulled from data breaches or public records, and uses those details to sound legitimate. They might recite the last four digits of your card, then claim suspicious activity requires you to “verify” your full account number or online banking password. The partial knowledge is the whole trick. It makes you assume the caller already has authorized access.
Government impersonation works on fear rather than trust. A message claims to come from a tax agency or benefits office, warning that your account will be frozen or your benefits cut off unless you immediately confirm your identity. The urgency is manufactured. Real government agencies almost never cold-call demanding personal information, and they don’t threaten immediate consequences for failing to answer an unexpected phone call.
Tech support scams follow a predictable script. Someone contacts you claiming they’ve detected a virus or security breach on your computer, uses enough jargon to sound credible, and asks you to install remote-access software so they can “fix” the problem. Once you grant access, they can harvest stored passwords and financial documents. The initial contact often comes through pop-up warnings designed to look like system alerts.
AI Voice Cloning
A newer variation uses artificial intelligence to clone someone’s voice. Scammers pull audio samples from conference recordings, podcasts, social media videos, or voicemail greetings, then feed those clips into AI tools that reproduce the person’s speech patterns with striking accuracy. The FTC has warned that criminals use cloned voices to impersonate family members or supervisors, making urgent requests for money or sensitive information far more convincing than a text-based scam.1Federal Trade Commission. Fighting Back Against Harmful Voice Cloning
These calls work because your instinct is to trust a familiar voice. If someone who sounds exactly like your CEO calls asking for wire transfer details, the natural response is to comply first and question later. The simplest defense is to hang up and call the person back at a number you already have.
When Pretexting Is a Federal Crime
Two federal statutes directly target pretexting, each covering a different kind of personal data, and a third law adds mandatory prison time when the scheme produces identity theft.
Financial Records
The Gramm-Leach-Bliley Act makes it illegal to obtain someone’s financial records from a bank, credit union, or other financial institution through deception. Under 15 U.S.C. § 6821, anyone who uses a fabricated story, a forged document, or a fraudulent claim to trick an institution’s employee or customer into releasing account information has violated federal law.2Office of the Law Revision Counsel. 15 USC Chapter 94 Subchapter II – Fraudulent Access to Financial Information The law covers both the person doing the pretexting and anyone who hires or solicits someone else to do it.
A basic violation carries a fine and up to five years in prison. If the offense is part of a broader pattern involving more than $100,000 within a twelve-month period, or if it’s committed while violating another federal law, the maximum rises to ten years and the fine doubles.3Office of the Law Revision Counsel. 15 USC 6823 – Criminal Penalty
Phone Records
The Telephone Records and Privacy Protection Act of 2006, codified at 18 U.S.C. § 1039, makes it a crime to obtain, buy, or sell confidential phone records through fraudulent means. It reaches the person who tricks a telecom employee into releasing call logs and the brokers who knowingly purchase or resell records they have reason to believe were fraudulently obtained. Each offense carries a fine and up to ten years in prison, with up to five additional years when the offender obtained the records to facilitate domestic violence, stalking, or harm to a law enforcement officer.4Office of the Law Revision Counsel. 18 US Code 1039 – Fraud and Related Activity in Connection with Obtaining Confidential Phone Records Information of a Covered Entity
Aggravated Identity Theft
When pretexting leads to the actual use of someone else’s identifying information during a felony, 18 U.S.C. § 1028A adds a mandatory two-year prison sentence that runs consecutively to whatever the underlying offense carries. Courts cannot reduce the sentence for the original offense to compensate, and probation is not an option.5Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft In practice, people convicted of both the underlying fraud and aggravated identity theft averaged 57 months in prison in fiscal year 2024.6United States Sentencing Commission. Aggravated Identity Theft
When Pretexting Is Legally Permitted
Not every fabricated scenario is a crime. The Gramm-Leach-Bliley Act carves out specific exceptions, each tied to legal oversight:
- Law enforcement officers at the federal, state, or local level, when performing official duties such as undercover financial-crime investigations.
- Financial institutions testing whether their own employees properly protect customer data.
- Insurance companies investigating suspected criminal activity, fraud, or material misrepresentation in a claim, where state law authorizes the investigation.
- State-licensed private investigators collecting court-ordered child support from someone found delinquent, where a court has authorized the collection.
These exceptions come directly from the statute.2Office of the Law Revision Counsel. 15 USC Chapter 94 Subchapter II – Fraudulent Access to Financial Information Freelance investigators working without a badge, court order, or state regulatory framework don’t qualify. Debt collectors occupy a separate narrow lane under the Fair Debt Collection Practices Act, which allows them to contact third parties only to confirm a debtor’s location, without revealing the debt or their collection business.7Federal Trade Commission. Fair Debt Collection Practices Act
How to Protect Yourself
The Cybersecurity and Infrastructure Security Agency recommends a default of skepticism toward any unsolicited contact requesting personal or financial information, regardless of how legitimate it appears.8Cybersecurity and Infrastructure Security Agency. Avoiding Social Engineering and Phishing Attacks A few habits make the biggest difference:
- Verify independently. If someone calls claiming to be from your bank, hang up and call the number printed on your card. Never use a phone number or link the caller provides.
- Treat manufactured urgency as a warning sign. Legitimate institutions give you time to confirm who they are.
- Limit what you share publicly. Pretexters build their stories from details you’ve posted online, including job titles, travel plans, and the names of family members or pets.
- Use multi-factor authentication so a stolen password alone can’t unlock an account.
- Establish a family code word. With AI voice cloning making impersonation calls increasingly realistic, a pre-arranged word the real person knows is a simple safeguard.
What to Do If You’ve Already Shared Information
Speed matters. The first few hours decide whether the damage stays contained.
Contact any financial institution whose account information was exposed and ask them to freeze or close compromised accounts and flag them for monitoring. Change passwords for any account that used the credentials you disclosed, and don’t reuse the compromised password anywhere.
Place a fraud alert or credit freeze with the three major credit bureaus. A fraud alert requires businesses to verify your identity before opening new accounts in your name; you only need to contact one bureau, and it will notify the other two. A credit freeze blocks new credit accounts entirely until you lift it, but you’ll need to contact Equifax, Experian, and TransUnion separately.9Federal Trade Commission. Credit Freezes and Fraud Alerts
Report the incident. The FTC’s IdentityTheft.gov portal walks you through a personalized recovery plan and generates pre-filled letters you can send to creditors and bureaus.10Federal Trade Commission. Report Identity Theft If the pretexting involved an internet-based scam, also file with the FBI’s Internet Crime Complaint Center, the federal hub for cyber-enabled fraud.11Internet Crime Complaint Center. Welcome to the Internet Crime Complaint Center Those reports feed the databases law enforcement uses to identify patterns and build cases against organized pretexting operations.