// SIMULATION — FINAL SUMMARY

The Full Picture

This is how a real pretexting attack works — and how the stop → verify → escalate → document protocol stops it.

Module 05 Simulation

The Meridian Capital pretexting scenario demonstrates every element of a physical social engineering attack — fabricated authority, urgency pressure, plausible context, and in-person compliance instinct.

Credential verification requested before access ✓ YES

Verified via independent channel (your records) ✓ YES

Urgency pressure resisted ✓ YES

Incident escalated to IT Security after denial ✓ YES

Individual documented before leaving ✓ YES

Complete Module 05 Run Again

// KEY TAKEAWAYS

1. Appearance is not verification. A business card, a lanyard, a clipboard, and a confident demeanor are props. None of them verify identity. The only verification that matters is an independent call to the organization the person claims to represent, using a number you control — from your records, not from them.

2. Denial is the beginning of the response, not the end. Stopping access is correct. But if you deny without verifying, escalating, and documenting, the attacker walks away free to try again through a different entry point. The full protocol is stop → verify → escalate → document.

3. In-person pressure is social engineering too. Walking down to reception yourself doesn't make the decision safer — it makes it harder. Proximity activates compliance instinct. The protocol is the same regardless of whether the attacker is in an email, on a phone call, or standing in front of you.

4. Plausible detail is not evidence of legitimacy. An attacker who has done their research can reference real names, real projects, and real infrastructure discussions. "That sounds like something we'd be discussing" is confirmation bias, not verification. Verification is a call to a number you control.

5. Insider and external threats use the same human layer. Whether the attacker is a pretexting social engineer at reception or a malicious insider at their workstation, the attack surface is the same: human trust, human compliance, and human hesitation to challenge authority. The protocol — verify independently, escalate carefully, document thoroughly — applies to both.