AI Voice Phishing Calls
It answers your questions, holds its nerve, and dials the next number.
What Is AI Voice Phishing Calls?
A scam call no longer has to be read from a script by a person. A conversational voice agent answers your follow-up questions, routes you through a menu, waits on hold with you and works hundreds of numbers in a morning without ever losing patience. In this exercise you take one of those calls, find the one thing about it that cannot be faked, end it, and verify on a number you already hold.
What You'll Learn in AI Voice Phishing Calls
- Recognise that a caller's fluency, patience and ability to answer follow-up questions say nothing about who they are, because a conversational voice agent is built to do exactly that
- Treat the request as the tell rather than the voice: no helpdesk, bank or manager has any use for the code from your authenticator, so the ask ends the call whoever is making it
- Read an automated menu, a keypress and a spell on hold as stagecraft that costs nothing to build and verifies nothing
- Reject internal detail as proof of identity, since references, deadlines and ticket numbers are circulated to thousands of people
- Verify out of band by hanging up and calling a number you already hold, never an extension or number offered during the call
- Report a call you refused, because a phone call leaves no record in any company system and the same list is still being dialled
AI Voice Phishing Calls — Training Steps
-
Migration Week
Claims is three days out from the authenticator cutover at Tollcastle Insurance, and the floor has been nagged about it since Monday. The notice is still near the top of your inbox.
-
The Line Near the Bottom
Most of the notice is housekeeping. One paragraph in it is a rule, and it was written down three days before anyone needed it.
-
Tollcastle IT Helpdesk Calling
Your mobile lights up at ten to ten. The screen says Tollcastle IT Helpdesk. That name is not a fact about the caller. It is a label attached to the call by whoever placed it.
-
Press 1 to Continue
Before he will go any further he hands you to a recorded line. There is a company name, a notice about recording, and a keypress.
-
On Hold, Then Back
The line goes quiet for a few seconds, and then he is back and apologising for the wait. You ask whether you can take his extension and ring him back through the service desk. He has an answer ready for that too.
-
The Ask
He is waiting on the line for six digits.
-
Hang Up On Him
He is still mid sentence. You do not owe a stranger the end of it.
-
Ring the Number You Already Have
He gave you extension 4112. It came out of the same call as everything else, so it is worth exactly what everything else is worth. The service desk number is in your contacts, copied from the intranet directory when you joined.
-
Four Calls Before Ten
Two of them said the six digits out loud.
-
Somewhere Someone Can Act On It
The service desk will lock the two accounts. Nothing anywhere records that your phone rang at all, because a phone call does not touch a single system Tollcastle Insurance runs. Information Security reads the morning's reports together. That is how four unconnected calls turn into one campaign with a name.
Security Framework Coverage
MITRE ATT&CK
- T1566.004 Phishing: Spearphishing Voice
- T1598 Phishing for Information
- T1111 Multi-Factor Authentication Interception
CIS Controls
- CIS 14.2 Train Workforce Members to Recognize Social Engineering Attacks
- CIS 14.3 Train Workforce Members on Authentication Best Practices
NIST CSF
- PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
EU AI Act
- Art. 50 Transparency obligations for providers and deployers
- Art. 4 AI literacy