What happened
Kevin Mitnick was arrested by the FBI in Raleigh, North Carolina on 15 February 1995 and found with cloned cellular phones, more than 100 cloned cellular phone codes and multiple pieces of false identification. In 1999 he pleaded guilty to four counts of wire fraud, two counts of computer fraud and one count of illegally intercepting wire communications, and admitted copying proprietary software from large cellular telephone and computer companies. He was sentenced to 46 months plus 22 months for violating supervised release. His case is the formative reference point for social engineering as a discipline.
How the deception worked
Mitnick's intrusions leaned far more on telephone pretexting than on exploits. He would call employees while posing as a colleague from another department, a vendor engineer or an internal support technician, using accurate internal jargon, employee names and project references gathered from earlier calls and from discarded documents. Each call extracted a small, individually harmless item, a dial-in number, a system name, a temporary password reset, and those items compounded into working access. The lever was deference to apparent internal authority and the desire to be helpful to a co-worker under time pressure.
AI involvement · No AI reported
No AI involvement; the era predates generative tooling.
The control that would have caught it· our reading, not a claim from the sources
Identity verification for any internal request must be independent of the caller's own claims, and password resets should require an out-of-band confirmation the caller cannot supply by talking.
Sources (1)
This entry summarises public reporting. It is not a legal finding, and details can change as investigations conclude. Found an error? Send a correction.