Hacking people, not computers: what Kevin Mitnick taught

Series: How minds are moved · Social engineering: the attack on one mind at a time · 1 of 6

On 15 July 2020, Twitter’s own staff were talked into helping attackers take over 130 accounts, among them the accounts of Barack Obama, Joe Biden, Elon Musk and Apple. No one broke the encryption and no one used a zero-day. According to the New York State Department of Financial Services, the attackers phoned a handful of remote employees, said they were from Twitter’s IT department, and sent them to a fake VPN login page. Four employees typed in their credentials. Within a day, a Bitcoin “double your money” scam had collected at least $118,000.

Kevin Mitnick had described the method nearly twenty years earlier. My AI agent and I went back through his book to see what still holds.

Contents · 9 sections

TL;DR #

• Social engineering attacks the person who has access, not the machine. Pretexting is its core move: an invented story plus a borrowed role, used to get information or an action.
• Kevin Mitnick’s The Art of Deception (2002), which sits in my library, is still the clearest description of the pattern. The weakness he named is helpfulness, not stupidity.
• Documented cases cover criminals (Twitter 2020, MGM Resorts 2023) and respectable corporations (Hewlett-Packard 2006). The method doesn’t care who uses it.
• Verizon’s 2025 breach report puts a human element in about 60% of breaches.
• The defence is dull and it works: verify through a channel you choose, never through the one the caller gives you.

Who Mitnick was, briefly #

Mitnick was the best-known hacker of the 1990s. He was arrested by the FBI in February 1995 and released in 2000 after about five years in custody, most of it before trial. He then spent two decades as a security consultant and died of pancreatic cancer on 16 July 2023, aged 59. Opinions of him still differ. Some see a reformed showman, others a pioneer who taught companies something they did not want to hear. His record is documented. So is the lesson of the book.

The opening chapter of The Art of Deception is called “Security’s Weakest Link”. A company can buy the best locks and the best guards, he writes, and still the homeowner “remains vulnerable. Why? Because the human factor is truly security’s weakest link.” He also writes that the attacker “must find a way to deceive a trusted user into revealing information, or trick an unsuspecting mark into providing him with access.”

That is the whole field in two sentences. The rest of the book is variations.

What pretexting is #

A pretext is a story that makes a request sound normal. The person asking takes on a role: a colleague from another branch, the IT help desk, an auditor, a new manager, a supplier with an invoice problem. The role does the persuading. If you believe who the caller is, the request follows naturally.

Mitnick’s stories follow a pattern that is worth learning to recognise from the receiving end. I describe it here as a defender would see it, not as a recipe.

1. The caller already knows small things. Names, department titles, the internal word for a system. Mitnick calls this kind of harmless-looking fact a “poker chip”: it is spent to buy trust.
2. The call feels routine. The tone is friendly, a little busy, slightly apologetic. Nothing about it sounds like an attack.
3. The request is small, or it sounds small: read me a number, reset a password, confirm an address, click this link and log in so I can check the VPN.
4. Each answer becomes the next caller’s poker chip. Social engineering is often a chain of harmless requests to different people. No single person sees the whole picture.

Mitnick’s own warning is aimed at step one: “Just because somebody knows a company practice or uses internal terminology is no reason to assume that his identity doesn’t need to be verified in other ways.”

Three documented cases, three kinds of attacker #

In the Twitter case of 2020, the New York regulator’s report describes attackers who had studied the company’s structure and job titles, so they could sound like real IT staff. The pretext was topical: in the first months of the pandemic everyone was on VPN, and VPN trouble was believable. The regulator also found that Twitter had no chief information security officer at the time. A strong story met a weak process.

At MGM Resorts in September 2023, a cyberattack took down MGM’s systems in Las Vegas. In its filing to the US Securities and Exchange Commission, MGM put the hit to its quarterly earnings at about $100 million. MGM has not said how the attackers got in. The group that claimed the attack told journalists it found an employee on LinkedIn and then called the help desk, pretending to be that employee. That account comes from the attackers. Two months later, a joint advisory from the US cyber agency CISA and the FBI described the same group impersonating IT and help-desk staff by phone to obtain credentials.

The Hewlett-Packard case of 2006 matters because the pretexters worked for a respected company. To find out who on its board was leaking to the press, HP’s chair approved an investigation. Investigators hired by HP impersonated board members and journalists to get their phone records from phone companies. California’s attorney general said the records of 12 people were obtained this way. The chair resigned, criminal charges followed (later dropped or reduced), and Congress passed the Telephone Records and Privacy Protection Act of 2006, which makes this kind of pretexting a federal crime. Pretexting for bank records had already been banned in 1999.

Criminal gangs, teenagers and a Fortune 50 boardroom all used the same tool. That is the point worth keeping.

What it feels like from the inside #

People who fall for a pretext rarely feel fooled while it is happening. They feel helpful. Mitnick notes that the urge to help a colleague with a problem is part of what makes companies work, and that is exactly what the pretexter uses.

The emotions are ordinary ones:

• Relief, when the caller already knows the right names. It feels like the hard part, the identity check, is done.
• Mild social pressure. Refusing a friendly, busy person feels rude, and asking for a call-back feels like accusing them.
• Urgency. The VPN is down, the CEO is waiting, the auditor leaves at five.
• Competence. You solved someone’s problem. You feel good.

Afterwards comes shame, which keeps many victims quiet. That silence helps the next attack.

What it can and cannot do #

Pretexting is powerful against processes that rely on someone’s judgement in the moment. It is weak against processes that take the decision away from the moment.

The numbers support both halves. Verizon’s 2025 Data Breach Investigations Report, based on more than 12,000 confirmed breaches, found a human element in about 60% of them. Social actions such as phishing and pretexting were involved in roughly 23% of those human-element breaches. So it is common, but it isn’t everything.

It also fails often. Most calls are refused, most phishing pages never get a password, and a single rule kills most of the attack: verify through a channel you already trust. Mitnick’s own advice is to call the person back at the number listed in the company directory, not the number the caller gives you. That one rule would have stopped the Twitter attack, and probably the MGM one as well.

How to notice it #

• The caller or sender knows internal details, and you take that as proof of identity. It isn’t.
• The request skips a normal step “just this once”: no ticket, no second approver, no written confirmation.
• There is time pressure that you did not create.
• You are asked to act inside the channel the other person chose: their link, their number, their screen-share.
• The request is small, but it is a credential, a code, a reset, an address or a record. These are the poker chips.
• You feel slightly embarrassed to say “let me call you back”. That feeling is the attack working.

A short checklist for any team:

1. Hang up and call back on a number from the directory, not from the caller.
2. Help desks never reset a password or move a phone number on a voice call alone.
3. One-time codes are never read out to anyone, for any reason.
4. Saying “I need to verify this” is always allowed, and managers say so out loud.
5. Report attempts, even the failed ones. Each one is a poker chip someone else might spend.

Frequently asked questions #

Is pretexting illegal? #

It depends on what is obtained and where. In the United States, pretexting to get financial records has been illegal since 1999 and pretexting for phone records since 2006. Using a false identity to commit fraud is illegal almost everywhere. Penetration testers do it legally, with written permission from the target organisation.

Why do smart people fall for it? #

Because it doesn’t target intelligence. It targets helpfulness, politeness and routine. The Twitter employees worked at a technology company. The pretext simply fitted their real situation.

Isn’t training enough? #

Training helps people notice. Process is what protects them: call-back rules, two-person approval, no resets by voice alone. Mitnick’s book spends its last chapters on policy, not on awareness posters.

Are AI voices making this worse? #

Yes, they make the role easier to play, and I cover that in a later post in this series. But the defence doesn’t change: if you verify through your own channel, the quality of the voice doesn’t matter.

The lesson #

Mitnick’s most useful sentence isn’t about hackers at all. It is the one about verification: knowing the lingo proves nothing. Every pretext rests on one quiet assumption, that the person who sounds like an insider is one. Take that assumption away with a call-back, a second approver or a rule that is never broken, and the cleverest story in the world becomes a phone call that goes nowhere.