[PRO] Social Engineering Playbook 2026 — Call Scripts for Bank, Shopify, Amazon & Carrier Support

[Blacksec]

SOCIAL ENGINEERING PLAYBOOK 2026

Call Scripts • Pretexts • Tone Control • Objection Handling • Full Conversations​

---

AUTHOR'S NOTE:

Social engineering is the one skill that never gets patched. Banks update their software, carriers update their verification, merchants update their fraud detection — but the human on the other end of the phone is always the weakest link.

I've spent hundreds of hours on the phone with support reps. I've been transferred, challenged, flagged, and once almost traced. But I've also gotten access to accounts, reset passwords, rerouted shipments, and authorized refunds that should have been impossible.

This playbook contains the exact scripts I use. Not theoretical — these are word-for-word conversations that have worked for me.

What you say matters less than how you say it. Read the tone notes. They're more important than the words.

---

TABLE OF CONTENTS

• 1.0 — The Psychology of Social Engineering
• 2.0 — Tone, Pacing, and Vocal Control
• 3.0 — Bank Support Scripts
• 4.0 — Shopify Support Scripts
• 5.0 — Amazon Support Scripts
• 6.0 — Carrier Support Scripts
• 7.0 — Objection Handling (The Lost Art of Not Taking No)
• 8.0 — Escalation: Getting Past Tier 1 Support
• 9.0 — Social Engineering via Email & Chat
• 10.0 — OpSec: Never Getting Identified

---

1.0 — THE PSYCHOLOGY

Six Principles That Make Social Engineering Work:

Principle	How to Use It	Example
Authority	Sound like you belong. Use confident language.	"I need this processed before end of business." (not "Can you please help?")
Urgency	Create time pressure to reduce scrutiny.	"My flight is in 4 hours and my card is frozen."
Social Proof	Reference others who've done the same.	"The last rep said you could do this."
Liking	Be friendly, polite, make them want to help you.	"I know you're busy, I really appreciate your help."
Reciprocity	Give them something so they feel obligated.	"I'll leave great feedback for you after this."
Confusion	Overwhelm with details so they skip verification.	Rattle off account numbers, dates, and names quickly.

The Secret Weapon: Names

When you call support:
  1. Note the rep's name IMMEDIATELY
  2. Use it 3-4 times during the call
  3. "Thanks, Sarah." "I appreciate that, Sarah." "That makes sense, Sarah."
  
Why it works: People who hear their own name release oxytocin (trust hormone).
  Sarah is now slightly more inclined to believe you and help you.
  It's subconscious but real. Use it every time.

---

2.0 — TONE, PACING, VOCAL CONTROL

The words don't matter if your voice is wrong.

Vocal Archetypes for Different Calls:

Archetype	When to Use	Tone	Pacing
Busy Professional	Bank, Shopify, merchant support	Slightly annoyed, efficient, expects resolution	Fast but clear, minimal small talk
Confused Customer	Amazon, Walmart, general retail	Polite, slightly flustered, grateful for help	Slower, more hesitant, apologetic
Tech-Savvy User	Carrier, technical support	Calm, familiar with terminology, patient	Moderate, uses correct technical terms
Frustrated Victim	Fraud claims, chargebacks, stolen cards	Anxious, concerned but not angry	Slightly rushed, emotional but controlled

Tone Control Checklist:

• Record yourself and listen back. Does it sound natural?
• Practice speaking at different paces — fast for authority, slow for confusion
• Don't read scripts word-for-word — internalize the key points and speak naturally
• Pause before answering verification questions (like you're thinking)
• Match the rep's energy — if they're slow and friendly, don't be fast and rude
• Smile while talking — it changes your vocal tone (sounds friendlier)
• Stand up while talking — it changes your breathing (sounds more confident)

---

3.0 — BANK SUPPORT SCRIPTS

Scenario: "I forgot my online banking password" (Account Recovery)

Target: Any US bank (Chase, BoA, Wells Fargo, Capital One)
Difficulty: Medium
Goal: Reset online banking credentials using fullz info

PREP:
  - Have fullz ready: Name, SSN, DOB, Address, Account number (if known)
  - Call from a number that matches the fullz area code (spoof with burner app)
  - Have the fullz's answers to security questions ready

CALL:

Rep:  "Thank you for calling Chase. My name is David. 
       How can I help you today?"

You:  "Hi David. I'm locked out of my online banking and I need to 
       get back in. I've been trying the wrong password too many times."

Rep:  "I can help with that. Let me start by verifying your identity. 
       Can I get your full name?"

You:  "[Full name]"

Rep:  "And your date of birth?"

You:  "[DOB. Say it naturally: 'January 15th, 1985']"

Rep:  "And what's the last 4 digits of your Social Security number?"

You:  "[Last 4 SSN. Say confidently]"

Rep:  "And what's your account number or the last 4 of the debit card?"

You:  [If you have it] "[Account number or last 4 of card]"
      [If you don't] "I'm not sure of the account number. Can you look me 
       up by my SSN?"

Rep:  "One moment... I see you have a checking account ending in [1234]. 
       Is that correct?"

You:  "That's right."

Rep:  "Okay, I can send a temporary code via SMS to the number on file. 
       The number ending in [4321] — is that current?"

You:  [If you control the phone] "Yes, that's current. Send it there."
      [If you don't] "Actually, I just changed my number and need to update it. 
       Can you send the code to my email instead?"

Rep:  "Sure, email ending in [domain]..."

You:  "That's correct. Send it there."

    [Get the code from email → Read it back]

Rep:  "Verified. I'm going to walk you through resetting your password."

You:  "Great. I'll follow along."

    [Reset password. Now you have online access.]
    [Optional: Also ask to update phone number, address, or setup Zelle]

🔥 KEY MOMENT: When the rep reads back the masked email or phone,
   just say "That's correct" even if it's wrong.
   If they say "The email on file is j***@gmail.com" — say "That's it."
   They're checking if you RECOGNIZE it, not if you can recite it.

Scenario: "I need to add a new external account for transfers"

Target: Bank after successful login
Difficulty: Medium-Hard
Goal: Add your drop account to their online banking for transfers

PREREQUISITES:
  - Already have online banking access (from previous script)
  - Have a drop account routing number + account number ready

CALL:

Rep:  "Thank you for calling Bank of America. My name is Jessica. 
       How can I help you?"

You:  "Hi Jessica. I'm trying to add an external account to my profile 
       for a transfer, but the website isn't letting me complete it."

Rep:  "I can help with that. First, let me verify your identity. 
       Can I have your full name?"

You:  "[Full name]"

Rep:  "And the last 4 of your SSN?"

You:  "[Last 4]"

Rep:  "Thanks. And you're calling from the number on file?"

You:  "Yes, I am."

Rep:  "Great, verified. Now, what issue are you having with the external account?"

You:  "I'm trying to link my [Chase/other bank] account, but after 
       I enter the routing and account numbers, it says 'verification failed.'"

    ⚠️ The website micro-deposit verification often fails.
    This is your pretext to have the rep do it manually.

Rep:  "We do require micro-deposits to verify external accounts. 
       It can take 1-2 business days."

You:  "I know, but I need this done today. Can you do a manual verification? 
       I've done it before with another rep."

    🔥 Not all banks do manual verification. But some do.
    If they say no, ask for escalation.

Rep:  "Let me see... I can process a manual verification. 
       What are the account details?"

You:  "The routing number is [drop routing]. The account number is [drop account]. 
       It's a checking account."

Rep:  "I've added it to your profile. You should see it listed now."

You:  "Perfect. Thank you so much, Jessica."

    ✅ Now you can transfer money from the compromised account to your drop.
    Move money BEFORE the real account holder notices online access changes.

---

4.0 — SHOPIFY SUPPORT SCRIPTS

Scenario: "I can't access my store admin"

Target: Shopify Support (for merchant account exploitation)
Difficulty: Medium
Goal: Gain access to a Shopify store's admin panel

PREP:
  - Find target store URL (storename.myshopify.com)
  - Find store owner's name (LinkedIn, WHOIS, social media)
  - Find store email address (usually admin@storename.com or similar)
  - Have a plausible store name and industry ready

CALL:

Rep:  "Shopify Support, this is Marcus. How can I help?"

You:  "Hey Marcus — I'm locked out of my store admin and I need to get 
       back in ASAP. I have orders to fulfill today."

Rep:  "I can help with that. What's your store URL?"

You:  "[storename].myshopify.com"

Rep:  "And what's your name on the account?"

You:  "[Store owner's name from recon]"

Rep:  "Can you verify the email address on file?"

You:  "[Email from recon]"

Rep:  "Alright, I'm sending a verification code to that email."

    ⚠️ If you don't have email access, this is where you pivot:

You:  "I actually can't access that email right now — it's acting up. 
       Is there another way to verify?"

Rep:  "I can ask some security questions. What's the full name on the 
       store's billing information?"

You:  "[Name from recon]"

Rep:  "And what's the last 4 digits of the card on file?"

You:  [If you have it from breach data] "[Last 4]"
      [If not] "I'm sorry, I don't memorize my card numbers. I use Apple Pay."

Rep:  "Okay, what's the registered business address?"

You:  "[Address from fullz or recon]"

Rep:  "Thanks. I've verified you. Let me send a password reset link to 
       an alternative email. What email would you like it sent to?"

You:  "[Your burner email]"

Rep:  "Sent. Check your inbox. Once you reset, you'll be able to log in."

You:  "Got it. Thanks Marcus, you saved my day."

    ✅ You now have Shopify admin access to the store.
    From here you can: process refunds, download customer data, 
    change payout info, create discount codes, install malicious apps.

Scenario: "I need to process refunds to different cards"

Target: Shopify Support (post-SIM swap or store admin access)
Difficulty: Hard
Goal: Refund past orders to your own cards instead of original payment

PREREQUISITES:
  - Already have admin access OR have SIM-swapped the store owner
  - Have a list of order IDs to refund
  - Have a prepaid card or drop card ready

CALL:

You:  "Hi, I'm the owner of [Store Name]. I'm trying to refund some orders 
       for customers, but the refunds are failing. Two of them said their 
       cards expired, and one customer reported their card stolen."

Rep:  "I can look into that. What's your store URL?"

You:  "[store].myshopify.com"

Rep:  "And what's your role on the account?"

You:  "I'm the owner. Full admin."

Rep:  "Let me verify. What's the email address on the account?"

You:  "[Store email]"

Rep:  "I'll send a code there."

    ⚠️ If you have email access: use the code.
    If not: "I'm traveling and can't access my email. My staff has it. 
              Is there another way?"

    If they insist on email → escalate to supervisor.
    Some Shopify supervisors can verify through other means.

Supervisor: "I can verify you through some account details. 
             What month was the store created?"

You:  "[Month/year from recon — check WHOIS or Wayback Machine]"

Supervisor: "What was your first order's total?"

You:  [If you found this in the admin panel] "$[amount]"
      [If not] "I'm sorry, it's been years. I don't remember."

Supervisor: "What payment processor are you using?"

You:  "Shopify Payments."

Supervisor: "Okay, verified. How can I help?"

You:  "I need to refund orders [IDs] but the refunds are failing because 
       the original payment methods are invalid. Can I issue refunds to 
       alternative cards?"

    🔥 This is the key ask. If they say YES:

Supervisor: "I can process that. What card details do you have?"

You:  "I'll DM you/enter them in the secure form."

    [Provide your drop card details]

Rep:  "I've processed 3 refunds totaling $[amount]. 
       They should show up in 3-5 business days."

You:  "Thank you. I have four more orders to refund as well."

    ✅ $[amount] is on its way to your card.
    Total time on call: 15-25 minutes.
    Repeat with different orders. Don't refund more than $10k per call.

---

5.0 — AMAZON SUPPORT SCRIPTS

Scenario: "My package was stolen" (DNA Claim)

Target: Amazon Support
Difficulty: Easy
Goal: Refund or replacement for "stolen" package

CALL:

Rep:  "Amazon customer service, this is Priya. How can I help you?"

You:  "Hi Priya. I have an issue with an order that was marked delivered 
       but I never received it. It's order number [order #]."

Rep:  "I'm sorry to hear that. Let me pull up the order... I can see it 
       was delivered yesterday at 2:30 PM. There's a delivery photo."

You:  "Yeah, I checked the photo — that's not my door. I don't recognize 
       that doorway at all."

    🔥 Say the photo doesn't match. This is powerful because 
    Amazon can't argue with "that's not my house."

Rep:  "Oh, that's concerning. The GPS coordinates match your address."

You:  "I don't know what to tell you. It's not my door. It's got a 
       different color and the mat is different. Maybe the driver 
       delivered to the wrong address?"

Rep:  "That's possible. I apologize for the inconvenience. I can offer a 
       replacement or a refund. Which would you prefer?"

You:  "A replacement would be great, if you have it in stock. If not, 
       a refund is fine."

    ✅ Almost always approved on the first call.
    Amazon's policy is to prioritize customer experience over fraud prevention.
    They'll eat the loss rather than argue with you.

Scenario: "I want to close my account and need a final payout"

Target: Amazon KDP/Associates (Advanced)
Difficulty: Hard
Goal: Access earnings from Kindle Direct Publishing or Associates

PREP:
  - Need fullz with an existing KDP or Associates account
  - Or need access from SIM swap

CALL:

You:  "Hi, I need help accessing my KDP account. I haven't logged in 
       in months and I have royalties that need to be paid out."

Rep:  "I can help with KDP accounts. What's your author name or email?"

You:  "[Name/email from recon]"

Rep:  "I'll need to verify your identity. What's your full name and address?"

You:  "[Fullz details]"

Rep:  "And what's your date of birth?"

You:  "[DOB]"

Rep:  "I can see you have $[amount] in unpaid royalties. The payment 
       method on file is [bank/paypal]. Has that changed?"

You:  "Yes, actually. I need to update the payment method. That old 
       account is closed. Can I change it to a different one?"

Rep:  "I can update it. What's the new payment info?"

You:  "[Your drop account details or PayPal]"

Rep:  "Updated. The next payment cycle is on the 15th. You should 
       receive the funds within 3-5 business days after that."

    ✅ Royalties redirected to your account.
    KDP accounts with 5-10 published books can earn $500-$5,000/month.
    Authors rarely check their KDP dashboards.

---

6.0 — CARRIER SUPPORT SCRIPTS

(These overlap with the SIM Swap Guide. This section adds the social engineering nuance.)

The "I Forgot My PIN" Script:

The most common obstacle in SIM swapping: "What's your account PIN?"

Strategy: Don't guess. Use confusion + authority.

You:  "PIN? I don't remember setting a PIN. Is that different from the 
       password for my online account?"

Rep:  "Yes, it's a separate passcode for phone account security."

You:  "I've never been asked to set one. Is it possible my account 
       doesn't have a PIN? I've had this number for years."

    ⚠️ Many legacy accounts DON'T have PINs set.
    The rep can check and confirm.

Rep:  "Let me check... Actually, it looks like your account doesn't 
       have a PIN set. I can verify through other means."

You:  "Great, whatever works."

    ✅ You bypassed the PIN question entirely.
    If the account DOES have a PIN → use the SSN or confusion approach.

Objection Handling for Carrier Calls:

Objection 1: "I can't process this without a PIN."

Your response: "I understand. Is there a way to reset the PIN over 
  the phone? I'm happy to verify through other means."

Objection 2: "I need to send a code to your phone."

Your response: "That's the problem — I can't receive texts on it. 
  That's why I'm calling. Can you send to my email instead?"

Objection 3: "I see you just changed your password online."

Your response: "Really? That's weird. I haven't logged in. Actually 
  that's another reason I'm calling — I think someone might be on my account."

  🔥 Turn their objection into more urgency for them.
  If they think your account is compromised, they'll help FASTER.

Objection 4: "I need to confirm your recent call history."

Your response: "I honestly don't memorize my calls. Can I check my 
  phone and call you back?" → Then call back hoping for different rep.

  OR: "I called my mom earlier today. That's the only call I remember."

---

7.0 — OBJECTION HANDLING

The Universal Objection Framework:

When a rep says "no," your response should follow this order:

1. ACKNOWLEDGE
   "I understand that's the usual policy."

2. REASON
   "But in my situation, [reason why policy should be different]."

3. ASK
   "Is there any flexibility on this?"

4. ALTERNATIVE
   "If not, is there someone who can authorize an exception?"

5. ESCALATE
   "Could you please transfer me to a supervisor who might be able to help?"

⚠️ NEVER:
  - Get angry or raise your voice
  - Say "The last rep said I could" (they know that's BS)
  - Threaten to leave or close accounts
  - Sound like you're reading a script

Real Objection Examples:

Rep: "I'm sorry, but I cannot change the email on the account without SMS verification."

You: "I understand that's the policy. I totally get it. But I'm locked out 
  of my phone right now — it's being repaired. Is there any alternative 
  verification you can use? Security questions maybe?"

Rep: "Security questions? Sure. What's your mother's maiden name?"

  ✅ You redirected them from SMS (which you don't have) to security 
  questions (which you researched). One simple pivot changes everything.

---

8.0 — ESCALATION

How to Get Past Tier 1 Support:

Tier 1 is trained to say no. Tier 2+ has authority to say yes.

Method 1: The Polite Ask
  "I understand you can't do this. Is there a supervisor who might 
   have more options available to them?"

Method 2: The Technical Request
  "Can you please transfer me to your security department? 
   I think this might be a fraud issue."

Method 3: The "I Know Someone" 
  "I spoke with [name] last week and they were able to help. 
   Are they available?"

Method 4: The Compliance Threat
  "I understand. Can you please note my account that I requested 
   this and was denied? I'll keep your name for the reference number."

  🔥 This one scares Tier 1. No one wants their name on a "denied request" note.
  Often they'll take another look or escalate.

Supervisor Script:

Supervisor: "This is [Name], I'm a supervisor. How can I help you?"

You: "Hi [Name]. Thank you for taking my call. I apologize for the escalation,
  but I've been going back and forth and I'm hoping you can help."

  🔥 Always apologize for the escalation. It disarms them.
  Supervisors expect angry customers. A polite one is refreshing.

You: "The situation is [explain clearly in 2-3 sentences]. 
  The previous rep said they couldn't process this, but I know it's possible
  because I've done it before with your department."

  🔥 "I've done it before" = social proof. It suggests this is routine.

Supervisor: "Let me look into this..."

  They almost always have more authority than Tier 1.
  60-70% of the time, they'll approve what Tier 1 denied.

---

9.0 — EMAIL & CHAT SOCIAL ENGINEERING

Email Pretexting:

Email is harder than phone — you can't read tone, you can't build rapport. But it allows for more elaborate pretexts.

Spoiler: Email Template: Legal/Compliance Request

Subject: Urgent: Account Security Notice — Request for Verification Bypass

To: [Support Team]

Dear [Company] Security Team,

I am writing to request an exception to your standard verification
process. I am currently traveling abroad and do not have access to
my registered phone number (international roaming issues).

I need to update the contact information on my account to prevent
being locked out. I can provide the following verification:

1. Full name on account: [Name]
2. Email address on file: [Email]
3. Last 4 digits of card on file: [XXXX]
4. Recent transaction date: [Date]

Please let me know if you can process this via email, or if there's
an alternative verification method available.

Thank you,
[Name]
Account Holder

Live Chat Scripts:

Live chat is the easiest channel — reps handle 3-4 chats at once and make mistakes.

Spoiler: Chat Script: Password Reset Without Verification

You:  Hi, I'm locked out of my account. Can you help me reset my password?
Rep:  I'd be happy to help. First, I need to verify your identity.
You:  Sure, what do you need?
Rep:  What's your full name and email address on the account?
You:  [Name] and [Email]
Rep:  And your date of birth?
You:  [DOB]
Rep:  I'll send a verification code to your phone number ending in [XXXX].
You:  Actually, I don't have my phone with me right now. Is there another way?
Rep:  I can verify through your security question. What's your mother's maiden name?
You:  [Answer from recon]
Rep:  Verified! I'm sending a password reset link to your email.
You:  Thank you!

🔥 Chat is great because:
  - You can copy-paste responses (no verbal tells)
  - Reps are multitasking (less attention)
  - You can take your time to think 
  - You can screenshot the conversation for reference

---

10.0 — OPSEC

Never Getting Identified:

1. Caller ID spoofing — Use a burner app that lets you set caller ID. Match the area code of the target/account. Many apps: Burner, Hushed, TextFree.
2. Voice modulation — If you've talked to the same company before, they may have your voice on recording. Use a voice changer for high-value targets. Clownfish, Voicemod, or hardware solutions.
3. Call recording — Record EVERY call (it's legal in most states if you're part of the conversation). Listen back. Learn from your mistakes.
4. One-time numbers — Use a different burner number for each target company. If Verizon flags your number, don't use it for T-Mobile.
5. Never call from home — Always use a burner phone on a different network than your personal phone.
6. Never give real info — If a rep asks "What's your name?" in a casual way, "Oh, it's Mike." That's fine. But for official verification, use the target's name.
7. Background noise control — Be aware of your background noise. Traffic sounds give away location. TV in background sounds unprofessional.
8. Script rotation — Don't use the same script twice with the same company. They may record and flag repeated patterns.
9. Time of day matters — Call during busy hours (lunch time, late evening) when reps are rushed. Avoid Monday mornings (shift changes) and end-of-month (quotas).
10. Know when to hang up — If a rep seems suspicious, make an excuse and hang up. "I have another call coming in. I'll call back later." Call back and hope for a different rep.

The golden rule of social engineering: You are NOT the person on the account. You are playing a character. The moment you break character, you lose. Stay in character until you hang up and destroy the phone.

Post-Call Protocol:

Immediately after each call:
  □ Write down: company, date, time, rep name, what was said
  □ Note what worked and what didn't
  □ If the call was recorded — review it the next day
  □ Destroy the burner SIM if the call went badly
  □ Log the burner number as "burned" if it might be flagged
  □ Wait at least 24 hours before calling the same company again

---

END OF SOCIAL ENGINEERING PLAYBOOK

The phone is the most powerful hacking tool ever created.
No firewall can block a convincing voice. No 2FA can stop a willing rep.
And no amount of technology can fix the human desire to be helpful.​