Phishing is typically a deceptive message, often delivered by email, that tries to get someone to click a malicious link or open an attachment. Pretexting is a fabricated story used to influence behavior or extract information, often through dialogue such as phone calls or back-and-forth messages. In practice, both are social engineering, but pretexting relies more on sustained manipulation.
How phishing and pretexting differ in security awareness programs
Security awareness teams use the distinction to teach people what kind of manipulation they are likely to face and how to verify it. A phishing scenario is usually a mass-delivered lure that asks for an immediate click or credential action, while pretexting is a more conversational deception that depends on trust-building, context, and persistence.
The difference matters because the detection cues are different. Phishing training should sharpen attention to message cues, links, attachments, and urgency signals. Pretexting training should focus on identity verification, callback discipline, and resisting pressure to bypass process because the story sounds plausible.
Many awareness programmes treat both as social engineering, but they should not be trained with the same controls and examples. A person who can spot a suspicious email may still be vulnerable to a convincing phone call, help desk script, or back-and-forth message thread that slowly extracts details over time. Social Engineering Guide is useful here because it frames phishing and pretexting as related tactics within the wider influence model.
What each tactic is trying to achieve
Phishing usually aims for fast action: click the link, open the file, enter the password, approve the prompt, or hand over a code. The attacker relies on volume and speed, so awareness content often emphasises lookalike domains, malicious attachments, and urgent requests that compress judgement time.
Pretexting usually aims for conversation, not instant click-through. The attacker constructs a believable role or situation, then uses dialogue to gather information, reset access, or move the target toward an action that would not happen under normal verification. That is why pretexting training often needs scripts, escalation paths, and verification rules, not just “spot the fake email” examples. Pretexting Guide is the more precise reference when the issue is role-played deception rather than a message lure.
In practice, the two tactics can blend. A phishing email may start the interaction, then the attacker follows up by phone or chat to deepen trust. Conversely, a pretext may be used first and then supported by a message containing a link or attachment once the victim is engaged.
How to train people to recognise the difference
Awareness programmes work better when they train the behaviour that should follow the suspicion, not just the label. For phishing, that means pausing before clicking, checking the sender and destination, and reporting the message through the approved channel. For pretexting, that means verifying the requester through a known channel, refusing to rely on the caller ID or display name alone, and escalating when the request involves credentials, access, or sensitive data.
The practical lesson is that a “good catch” is not the same as a blocked email. A phishing simulation may measure click or report rates, but a pretexting exercise should test whether staff can hold the line under conversational pressure and still complete verification. Security Awareness and Human Risk Management Guide and Phishing Simulation Programme Guide both help show how programme design and measurement should differ by tactic.
Risk and Threat Considerations
Both tactics create the same underlying risk, unauthorized access through human trust, but the exposure path differs. Phishing typically concentrates risk in message channels and user clicks, while pretexting concentrates risk in help desks, support teams, executives, assistants, and any process that allows exceptions under pressure.
Failure mechanism: The attacker succeeds when the target treats a plausible story as a verified request, or treats a familiar-looking message as a safe one without independent verification. Pretexting is especially effective when staff are trained to be helpful but not to challenge the requester.
Impact: Successful social engineering can lead to credential theft, payment diversion, mailbox compromise, help desk abuse, or broader account takeover. Once a trusted channel is bypassed, the attacker often uses the first foothold to widen access or impersonate the victim again.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0, OWASP ASVS and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-14 — Security Awareness and Skills Training | Social engineering awareness and verification training directly support this distinction. |
| Recommendation — Use role-based awareness content to train users on phishing cues and pretext verification habits. | ||
| NIST CSF 2.0 | PR.AT-01 — All personnel are provided with security awareness and training | The question is about awareness-program content for social engineering. |
| PR.AT-02 — All personnel are provided with awareness and training | Awareness programs must teach personnel to recognise and respond to deceptive requests. | |
| PR.AT-03 — Privileged users understand their roles and responsibilities | Pretexting often targets help desks, executives, and other higher-trust users. | |
| Recommendation — Tailor awareness training to the attack path, including phishing and pretexting behaviors. Include scenario-based training that distinguishes email lures from conversational deception. Train privileged and high-trust users to verify requests before taking exception actions. | ||
| OWASP ASVS | V6 — Authentication | Pretexting and phishing often aim to capture or misuse authentication secrets and prompts. |
| Recommendation — Harden authentication flows so users can verify requests before revealing credentials or codes. | ||
| NIST SP 800-53 Rev 5 | AT-2 — Awareness Training | Awareness training is the core control family for social engineering resilience. |
| AT-3 — Role-Based Training | Different roles face different social engineering patterns and verification duties. | |
| IA-5 — Authenticator Management | Phishing and pretexting frequently target credentials, OTPs, and reset workflows. | |
| Recommendation — Deliver recurring training on phishing, pretexting, and required user responses. Provide role-specific guidance for help desk, finance, executives, and support staff. Protect authenticators and reset paths against disclosure or social engineering abuse. | ||
Practitioner Guidance
What to prioritise: Teach people that the response differs by tactic. If the danger is a phishing lure, the first control is reporting and link avoidance; if the danger is a pretext, the first control is out-of-band verification and refusal to improvise around process.
What to verify: The best test is whether staff can explain what evidence they would trust before acting. For pretexting, that should include a known callback path, a required verification step, and a clear rule for when to stop the conversation and escalate.
Practitioner takeaway: The useful distinction is not just “email versus phone”, it is “speed-and-click pressure versus trust-and-dialogue pressure”, and your programme should train different reflexes for each.
Related resources from NHI Mgmt Group
- How should security teams adapt awareness programs as phishing and social engineering become more personalized and localized?
- How should security teams structure phishing awareness programs when training time is limited?
- Why do interactive and relatable security awareness programs reduce phishing risk more effectively than lecture-style training?
- Why does annual security awareness training fail against modern phishing?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org