Pretexting Attack Chain: Authority Exploitation Funnel

Pretexting Attack Chain

Stack social-engineering techniques onto one pretext call. Each toggle multiplies the target's live compliance probability — watch the particle funnel show exactly how many "employees" fall for it.

Techniques in the chain

Authority impersonation ×2.4

"This is IT Support" — caller claims a position of authority the target won't challenge.

False urgency ×1.7

"Your account locks in 10 minutes" — no time to verify or ask a colleague.

Rapport building ×1.5

Small talk, using the target's name and team — manufactured familiarity.

Social proof ×1.4

"Two other people on your floor already did this" — implies compliance is normal.

Reciprocity ×1.3

A small unsolicited favor offered first, priming an instinct to repay it.

Live outcome

Crude request (baseline)

no technique, direct ask

Current chain

×1.0 amplification

Simulated targets processed / compromised

0 / 0

Flow speed1.0×

Why compounding works

A single crude request ("give me your password") is easy to refuse — most people recognize it instantly. Each additional technique removes a different psychological guardrail: authority discourages pushback, urgency removes time to verify, rapport lowers suspicion, social proof normalizes compliance, reciprocity creates an obligation.

Techniques don't add — they multiply. Two mediocre techniques can outperform one strong one.
The funnel below is a live Monte-Carlo simulation: each particle carries a fixed random resistance score, checked against the current cumulative probability as it falls past each active stage.
Defense: any single step in the chain (verify caller identity, slow down, check with a colleague) breaks the multiplication.

Falling target (undecided) Compromised (complied) Resisted (drifted off) Baseline reference ring

⚠️ WebGL unavailable in this browser

Try updating your browser or enabling hardware acceleration.