Which term describes social engineering that uses a fabricated scenario to obtain sensitive information?

Which term describes social engineering that uses a fabricated scenario to obtain sensitive information?

• A. Pretexting
• B. Phishing
• C. Shoulder surfing
• D. Quid pro quo

Answer: (A)

Creating a plausible scenario or persona to coax someone into revealing sensitive information is pretexting. The attacker adopts a believable role—like IT support, a bank employee, or a coworker—and uses that story to persuade the target to disclose credentials, security answers, or other data, or to perform actions that compromise security. The tactic works because the target accepts the situation as legitimate and relays information or access under the assumed pretext. This differs from phishing, which relies on fake messages or websites to harvest data rather than a carried-out in-person or voice pretext. It also differs from shoulder surfing, which is simply watching someone enter their credentials, and from quid pro quo, where something is offered in exchange for information rather than a constructed scenario used to elicit it.

Creating a plausible scenario or persona to coax someone into revealing sensitive information is pretexting. The attacker adopts a believable role—like IT support, a bank employee, or a coworker—and uses that story to persuade the target to disclose credentials, security answers, or other data, or to perform actions that compromise security. The tactic works because the target accepts the situation as legitimate and relays information or access under the assumed pretext.

This differs from phishing, which relies on fake messages or websites to harvest data rather than a carried-out in-person or voice pretext. It also differs from shoulder surfing, which is simply watching someone enter their credentials, and from quid pro quo, where something is offered in exchange for information rather than a constructed scenario used to elicit it.