AI Voice Phishing Calls

AI Voice Phishing Calls

It answers your questions, holds its nerve, and dials the next number.

What Is AI Voice Phishing Calls?

A scam call no longer has to be read from a script by a person. A conversational voice agent answers your follow-up questions, routes you through a menu, waits on hold with you and works hundreds of numbers in a morning without ever losing patience. In this exercise you take one of those calls, find the one thing about it that cannot be faked, end it, and verify on a number you already hold.

What You'll Learn in AI Voice Phishing Calls

AI Voice Phishing Calls — Training Steps

  1. Migration Week

    Claims is three days out from the authenticator cutover at Tollcastle Insurance, and the floor has been nagged about it since Monday. The notice is still near the top of your inbox.

  2. The Line Near the Bottom

    Most of the notice is housekeeping. One paragraph in it is a rule, and it was written down three days before anyone needed it.

  3. Tollcastle IT Helpdesk Calling

    Your mobile lights up at ten to ten. The screen says Tollcastle IT Helpdesk. That name is not a fact about the caller. It is a label attached to the call by whoever placed it.

  4. Press 1 to Continue

    Before he will go any further he hands you to a recorded line. There is a company name, a notice about recording, and a keypress.

  5. On Hold, Then Back

    The line goes quiet for a few seconds, and then he is back and apologising for the wait. You ask whether you can take his extension and ring him back through the service desk. He has an answer ready for that too.

  6. The Ask

    He is waiting on the line for six digits.

  7. Hang Up On Him

    He is still mid sentence. You do not owe a stranger the end of it.

  8. Ring the Number You Already Have

    He gave you extension 4112. It came out of the same call as everything else, so it is worth exactly what everything else is worth. The service desk number is in your contacts, copied from the intranet directory when you joined.

  9. Four Calls Before Ten

    Two of them said the six digits out loud.

  10. Somewhere Someone Can Act On It

    The service desk will lock the two accounts. Nothing anywhere records that your phone rang at all, because a phone call does not touch a single system Tollcastle Insurance runs. Information Security reads the morning's reports together. That is how four unconnected calls turn into one campaign with a name.

Security Framework Coverage

MITRE ATT&CK

  • T1566.004 Phishing: Spearphishing Voice
  • T1598 Phishing for Information
  • T1111 Multi-Factor Authentication Interception

CIS Controls

  • CIS 14.2 Train Workforce Members to Recognize Social Engineering Attacks
  • CIS 14.3 Train Workforce Members on Authentication Best Practices

NIST CSF

  • PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind

EU AI Act

  • Art. 50 Transparency obligations for providers and deployers
  • Art. 4 AI literacy