The monitor from your desk at home casts a pale halo on your face. It's late. You find **Lena Patel’s** LinkedIn profile. Her headline reads: *"Risk Oversight: Where the real power lies. (And yes, I do know things.)"* You send her a connection request with a message: > *"Hi Lena, I’m a former colleague of Sophie Chen’s from her Blackridge days. I’m working on a project about risk management in investment firms and would love to pick your brain about how Risk Oversight teams operate. Sophie mentioned you were a great resource, would you be open to a quick chat?"* You hit send. The request sits there, "Pending". A day passes. Then: > **Lena Patel**: *"Hi! Sophie’s a sweetie. I’d be happy to help, but… compliance. That said, if you’re asking about Isabella, just know she’s the kind of person who notices when you ask too many questions. And if you’re asking about Marc… well, let’s just say he’s the reason some of us left."* Lena’s cautious, but she’s engaging. She’s playing along, for now. --- **What do you do?** - **Ask about Isabella Laurent**: Lena works in Risk Oversight, she must know her boss’s habits. [[Cybercrime/The_Phisherman/Ask Lena About Isabella|Ask about Isabella Laurent]] - **Ask about PRAP**: Lena might know how the system works in practice. [[Cybercrime/The_Phisherman/Ask Lena About PRAP|Ask about PRAP]] - **Back off**: This is getting too close to Blackridge's internal operations. [[Abandon this trail|Back off and end the conversation]] <details> <summary>🔎 Behind the curtain: pretexting and borrowed trust</summary> <p>You have not hacked anything here. You have invented a believable role and borrowed someone's name to inherit the trust attached to it. That is <b>pretexting</b>: building a cover story ("I'm a former colleague of Sophie's") so the target lowers their guard and shares what they would never hand a stranger. The trusted name does the heavy lifting, because people vouch by association without checking. It scales frighteningly well. In 2023 attackers broke into MGM Resorts not with malware but with a phone call: posing as an employee, with details lifted from LinkedIn, they talked the IT help desk into a password reset, and the outage reportedly cost the company around 100 million dollars.</p> <p><b>Defender's lesson:</b> verify identity through a channel the caller does not control, and be most careful exactly when a request arrives wrapped in a familiar name or a shared connection.</p> </details>