i hacked my grandma (social engineering and pretexting) // FREE Security+ // EP 3

A pair of phone calls—one to a wife and one to a grandmother—demonstrated how pretexting can harvest personal data with little technical sophistication. By impersonating familiar brands (“Anita from Lowe’s” and “Anita from State Farm”), using a Raspberry Pi setup to spoof local caller ID, and pressing for sensitive details like home addresses and credit-card information, the attacker tried to convert trust into actionable identity data. The wife and grandmother both refused to provide full credit-card details, but both did share addresses—enough to show how even partial compliance can create real risk.

The Lowe’s pretexting attempt leaned on a plausible shopping narrative: the caller claimed to be confirming a front-door order and said the address was “misplaced,” then asked for the installation address and credit-card details on file. To make the story feel credible, the attacker tested the setup the day before and even had the target see the “Lowe’s” caller ID, so the next day’s call started with the target already expecting a Lowe’s contact. During the call, the pressure escalated from confirming the address to requesting card verification, with the caller suggesting the payment didn’t go through and offering to resolve it immediately.

The grandmother’s call used a similar structure but with a different pretext: insurance trouble. The caller claimed the policy payment failed and framed it as urgent, asking for the address and then for the last four digits of the credit card on file. Even when the connection was poor and the target couldn’t hear well, the script kept returning to the same goal—confirm identity details and payment information—because those are the building blocks for fraud. The grandmother ultimately did not provide the credit-card information, but did provide an address.

From there, the discussion broadened to identity theft and identity fraud, tying the phone scams to a larger threat ecosystem. Identity theft is described as fundamentally simple: someone pretends to be you. Much of the groundwork comes from information people already publish online, and from social engineering tactics like phishing and voice-based impersonation. The most dangerous pathway, however, is often outside individual control: data breaches. Examples cited include a Microsoft support database exposure involving 280 million customer records, MGM Resorts leaking 10.6 million hotel guests’ personal information (later updated to 142 million records), and a T-Mobile incident tied to a third-party email vendor compromise that exposed sensitive customer data.

To check whether personal data has been exposed, the transcript points to “Have I Been Pwned,” where users can enter an email address to see whether it appears in known breaches. If it does, the recommended response is immediate password changes, since breached credentials can be reused. The consequences of identity theft range from fraudulent purchases—such as a reported attempt to buy something from a vending machine—to larger-scale impersonation, including applying for credit, buying high-value items, or targeting others through compromised social accounts.

Finally, the transcript highlights that impersonation doesn’t have to be about a specific person. It can be about access: “tailgating” is described as an employee-impersonation tactic where an attacker follows someone through a secured door, relying on social pressure to hold the entrance open. The takeaway is blunt: vigilance matters because accounts and data assumed to be secure can leak, and confidence-based impersonation can work even without sophisticated hacking.