Pretexting in the Wild

The Uncanny Adventures at Geek Squad —

A gentleman came in today, worried and shaken.

He said his bank had called him — two unauthorized checks had been deposited into his account.

Instinctively I asked the first question every security-minded person should:

“Did you change your password?”

“Yes,” he said. “The banker helped me reset it over the phone.”

Good… right?

My team lead and I inspected his phone — apps, settings, update history, anything suspicious.

Nothing. No malware. No strange apps. No signs of compromise.

Something felt off.

If there was no device-level breach… then how did someone access his banking credentials?

Then it hit me.

Two forged checks.

A phone call from “the bank.”

Password reset — with the caller still on the line.

No technical signs of intrusion.

The attack wasn’t digital.

It was pretexting.

A threat actor pretending to be someone trustworthy — to gain access willingly.

I asked the gentleman to call the “banker” back.

Dead line.

No connection. No institution. No banker.

We immediately reset his account credentials properly and secured access.

⸻

Lesson of the day:

Never trust an inbound call.

If someone claims to be from your bank, your ISP, the IRS — hang up and call back using a number you personally look up.

If it’s real, they’ll verify you.

If it’s fake, you just dodged a bullet.

Cybersecurity isn’t just firewalls, malware scans, or endpoints —

Sometimes the most dangerous vulnerability is human trust.