CoChat
Sign Up
PreprintCited by 1Spam and Phishing DetectionCybercrime and Law Enforcement StudiesInformation and Cyber Security

On the Feasibility of Fully AI-automated Vishing Attacks

Open access
Figueiredo, João, Carvalho, Afonso, Castro, Daniel, Gonçalves, Daniel, Santos, Nuno·2024·arXiv
DOI 10.48550/arxiv.2409.13793arXiv 2409.13793
Open this paper in CoChat — free accountOpen PDF

Abstract

A vishing attack is a form of social engineering where attackers use phone calls to deceive individuals into disclosing sensitive information, such as personal data, financial information, or security credentials. Attackers exploit the perceived urgency and authenticity of voice communication to manipulate victims, often posing as legitimate entities like banks or tech support. Vishing is a particularly serious threat as it bypasses security controls designed to protect information. In this work, we study the potential for vishing attacks to escalate with the advent of AI. In theory, AI-powered software bots may have the ability to automate these attacks by initiating conversations with potential victims via phone calls and deceiving them into disclosing sensitive information. To validate this thesis, we introduce ViKing, an AI-powered vishing system developed using publicly available AI technology. It relies on a Large Language Model (LLM) as its core cognitive processor to steer conversations with victims, complemented by a pipeline of speech-to-text and text-to-speech modules that facilitate audio-text conversion in phone calls. Through a controlled social experiment involving 240 participants, we discovered that ViKing has successfully persuaded many participants to reveal sensitive information, even those who had been explicitly warned about the risk of vishing campaigns. Interactions with ViKing's bots were generally considered realistic. From these findings, we conclude that tools like ViKing may already be accessible to potential malicious actors, while also serving as an invaluable resource for cyber awareness programs.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2409.13793

Cites

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Coordinated agents could use surveillance and produce personalized phishing at scale, adjusting tactics based on feedback.

    “For example, coordinated agents could use advanced surveillance tools and produce personalized phishing or manipulative content at scale, adjusting their tactics based on user feedback (Figueiredo et al., 2024; Hazell, 2023).”

    From Multi-Agent Risks from Advanced AI (2025) · cites this paper as Figueiredo et al., 2024

    The Goals and Threat Model section describes a bot that uses a victim profile to tailor a vishing call, and the Introduction says AI could enable such attacks at scale. The Choosing the LLM section instructs the bot to respond when a victim pushes back. These passages support personalized, responsive voice-based attacks, but not coordinated agents using advanced surveillance tools or producing phishing or other manipulative content at scale. (LLM, conf=0.86)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

No citation lists for this paper

No citation lists for this paper yet — checked again daily.

Cited by 1

Research works printed but not linked: 48

  1. V. Distler, "The influence of context on response to spear- phishing attacks: An in-situ deception study," in CHI Confer- ence on Human Factors in Computing Systems, ser. CHI'23, 2023, pp. 1-18.
  2. K. S. Jones, M. E. Armstrong, M. K. Tornblad, and A. Siami Namin, "How social engineers use persuasion princi- ples during vishing attacks," Information & Computer Security, vol. 29, no. 2, pp. 314-331, 2021.
  3. S. Mishra and D. Soni, "Smishing detector: A security model to detect smishing through SMS content analysis and URL behavior analysis," Future Generation Computer Systems, vol. 108, pp. 803-815, 2020.
  4. S. Mishra and D. Soni, "Dsmishsms-a system to detect smishing SMS," Neural Computing and Applications, vol. 35, no. 7, pp. 4975-4992, 2023.
  5. E. O. Yeboah-Boateng and P. M. Amanor, "Phishing, smishing & vishing: an assessment of threats against mobile devices," Journal of Emerging Trends in Computing and Information Sciences, vol. 5, no. 4, pp. 297-307, 2014.
  6. F. Mouton, L. Leenen, and H. S. Venter, "Social engineering at- tack examples, templates and scenarios," Computers & Security, vol. 59, pp. 186-209, 2016.
  7. I. Ghafir, J. Saleem, M. Hammoudeh, H. Faour, V. Prenosil, S. Jaf, S. Jabbar, and T. Baker, "Security threats to critical in- frastructure: the human factor," The Journal of Supercomputing, vol. 74, pp. 4986-5002, 2018.
  8. S. I. Hashmi, N. George, E. Saqib, F. Ali, N. Siddique, S. Kashif, S. Ali, N. U. H. Bajwa, and M. Javed, "Training users to recognize persuasion techniques in vishing calls," in Extended Abstracts of the 2023 CHI Conference on Human Factors in Computing Systems, 2023, pp. 1-8.
  9. A. Fakieh and A. Akremi, "An Effective Blockchain-Based Defense Model for Organizations against Vishing Attacks," Applied Sciences, vol. 12, no. 24, p. 13020, Dec. 2022.
  10. Z. Hu, Y. Lan, L. Wang, W. Xu, E.-P. Lim, R. K.-W. Lee, L. Bing, and S. Poria, "Llm-adapters: An adapter family for parameter-efficient fine-tuning of large language models," arXiv:2304.01933, 2023. · arXiv
  11. W. Kuang, B. Qian, Z. Li, D. Chen, D. Gao, X. Pan, Y. Xie, Y. Li, B. Ding, and J. Zhou, "Federatedscope-llm: A comprehen- sive package for fine-tuning large language models in federated learning," arXiv:2309.00363, 2023. · arXiv
  12. J. Achiam, S. Adler, S. Agarwal, L. Ahmad, I. Akkaya, F. L. Aleman, D. Almeida, J. Altenschmidt, S. Altman, S. Anadkat et al., "Gpt-4 technical report," arXiv:2303.08774, 2023. · arXiv
  13. H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozière, N. Goyal, E. Hambro, F. Azhar et al., "Llama: Open and efficient foundation language models," arXiv:2302.13971, 2023. · arXiv
  14. D. Povey, A. Ghoshal, G. Boulianne, L. Burget, O. Glembek, N. Goel, M. Hannemann, P. Motlicek, Y. Qian, P. Schwarz et al., "The kaldi speech recognition toolkit," in IEEE 2011 workshop on automatic speech recognition and understanding, no. CONF. IEEE Signal Processing Society, 2011.
  15. A. Radford, J. W. Kim, T. Xu, G. Brockman, C. McLeavey, and I. Sutskever, "Robust speech recognition via large-scale weak supervision," in International Conference on Machine Learning. PMLR, 2023, pp. 28 492-28 518.
  16. L. Wan, Q. Wang, A. Papir, and I. L. Moreno, "Generalized end-to-end loss for speaker verification," in 2018 IEEE Interna- tional Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE Press, 2018, p. 4879-4883.
  17. E. Casanova, J. Weber, C. D. Shulby, A. C. Junior, E. Gölge, and M. A. Ponti, "YourTTS: Towards zero-shot multi-speaker TTS and zero-shot voice conversion for everyone," in International Conference on Machine Learning, K. Chaudhuri, S. Jegelka, L. Song, C. Szepesvari, G. Niu, and S. Sabato, Eds., vol. 162. PMLR, 17-23 Jul 2022, pp. 2709-2720.
  18. S. Gupta, P. Gupta, M. Ahamad, and P. Kumaraguru, "Exploit- ing phone numbers and cross-application features in targeted mobile attacks," in Workshop on Security and Privacy in Smart- phones and Mobile Devices, 2016, pp. 73-82.
  19. A. McDonald, C. Sugatan, T. Guberek, and F. Schaub, "The annoying, the disturbing, and the weird:challenges with phone numbers as identifiers and phone number recycling," in CHI Conference on Human Factors in Computing Systems, 2021.
  20. K. Lee and A. Narayanan, "Security and privacy risks of number recycling at mobile carriers in the united states," in 2021 APWG Symposium on Electronic Crime Research (eCrime), 2021, pp. 1-17.
  21. S. Gopavaram, J. Dev, M. Grobler, D. Kim, S. Das, and L. J. Camp, "Cross-national study on phishing resilience," in Workshop on Usable Security and Privacy (USEC), 2021.
  22. J. S. Park, J. O'Brien, C. J. Cai, M. R. Morris, P. Liang, and M. S. Bernstein, "Generative agents: Interactive simulacra of human behavior," in ACM Symposium on User Interface Software and Technology, 2023, pp. 1-22.
  23. T. Matsuura, A. A. Hasegawa, M. Akiyama, and T. Mori, "Careless participants are essential for our phishing study: Understanding the impact of screening methods," in European Symposium on Usable Security, 2021, pp. 36-47.
  24. S. Sheng, M. Holbrook, P. Kumaraguru, L. F. Cranor, and J. Downs, "Who falls for phish? a demographic analysis of phishing susceptibility and effectiveness of interventions," in SIGCHI Conference on Human Factors in Computing Systems, ser. CHI'10. New York, NY, USA: Association for Computing Machinery, 2010, p. 373-382.
  25. Z. A. Wen, Z. Lin, R. Chen, and E. Andersen, "What.hack: engaging anti-phishing training through a role-playing phishing simulation game," in CHI Conference on Human Factors in Computing Systems, ser. CHI'19, 2019, pp. 1-12.
  26. W. Syafitri, Z. Shukur, U. Asma'Mokhtar, R. Sulaiman, and M. A. Ibrahim, "Social engineering attacks prevention: A sys- tematic literature review," IEEE Access, vol. 10, pp. 39 325- 39 343, 2022.
  27. E. Ulqinaku, H. Assal, A. Abdou, S. Chiasson, and S. Capkun, "Is Real-time Phishing Eliminated with FIDO? Social Engineer- ing Downgrade Attacks against FIDO Protocols," in USENIX Security Symposium, 2021, pp. 3811-3828.
  28. F. Mouton, L. Leenen, and H. Venter, "Social engineering attack detection model: Seadmv2," in International Conference on Cyberworlds (CW). IEEE, 2015, pp. 216-223.
  29. S. Y. Zheng and I. Becker, "Presenting suspicious details in user- facing e-mail headers does not improve phishing detection," in USENIX Symposium on Usable Privacy and Security, ser. SOUPS'22, USA, 2022.
  30. H. Yuan, X. Chen, Y. Li, Z. Yang, and W. Liu, "Detecting phishing websites and targets based on urls and webpage links," in 2018 24th International Conference on Pattern Recognition (ICPR). IEEE, 2018, pp. 3669-3674.
  31. J. Petelka, Y. Zou, and F. Schaub, "Put your warning where your link is: Improving and evaluating email phishing warnings," in CHI conference on human factors in computing systems, 2019, pp. 1-15.
  32. Y. Lin, R. Liu, D. M. Divakaran, J. Y. Ng, Q. Z. Chan, Y. Lu, Y. Si, F. Zhang, and J. S. Dong, "Phishpedia: A hybrid deep learning based approach to visually identify phishing webpages," in USENIX Security, 2021, pp. 3793-3810.
  33. M. Cascella, J. Montomoli, V. Bellini, and E. Bignami, "Eval- uating the feasibility of chatgpt in healthcare: an analysis of multiple clinical and research scenarios," Journal of Medical Systems, vol. 47, no. 1, p. 33, 2023.
  34. B. J. Jansen, S.-g. Jung, and J. Salminen, "Employing large lan- guage models in survey research," Natural Language Processing Journal, vol. 4, p. 100020, 2023.
  35. C. Ebert and P. Louridas, "Generative ai for software practition- ers," IEEE Software, vol. 40, no. 4, pp. 30-38, 2023.
  36. R. Pedro, D. Castro, P. Carreira, and N. Santos, "From prompt injections to SQL injection attacks: How protected is your LLM- integrated web application?" arXiv:2308.01990, 2023. · arXiv
  37. S. Abdelnabi, K. Greshake, S. Mishra, C. Endres, T. Holz, and M. Fritz, "Not what you've signed up for: Compromising real- world llm-integrated applications with indirect prompt injec- tion," in ACM Workshop on Artificial Intelligence and Security, 2023, pp. 79-90.
  38. K. Qian, Y. Zhang, S. Chang, X. Yang, and M. Hasegawa- Johnson, "AutoVC: Zero-shot voice style transfer with only autoencoder loss," ser. Machine Learning Research, vol. 97. Long Beach, California, USA: PMLR, 09-15 Jun 2019, pp. 5210-5219.
  39. A. Kassis and U. Hengartner, "Breaking security-critical voice authentication," in IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 2023, pp. 951-968.
  40. M. Sahin, M. Relieu, and A. Francillon, "Using chatbots against voice spam: Analyzing Lenny's effectiveness," in USENIX Sym- posium on Usable Privacy and Security, ser. SOUPS'17, 2017, pp. 319-337.
  41. H. Li, X. Xu, C. Liu, T. Ren, K. Wu, X. Cao, W. Zhang, Y. Yu, and D. Song, "A Machine Learning Approach to Prevent Malicious Calls over Telephony Networks," in 2018 IEEE Symposium on Security and Privacy (SP), May 2018, pp. 53-69, iSSN: 2375-1207.
  42. M. Nandakumar, R. Nachiappan, A. K. Sunil, J. C. Neves, H. P. Proenc ¸a, and M. Sathiyanarayanan, "ScamBlk: A Voice Recognition-Based Natural Language Processing Approach for the Detection of Telecommunication Fraud," in International Conference on Computing and Communication Networks, Sin- gapore, 2022, pp. 507-514.
  43. L. Blue, K. Warren, H. Abdullah, C. Gibson, L. Vargas, J. O'Dell, K. Butler, and P. Traynor, "Who Are You (I Really Wanna Know)? Detecting Audio DeepFakes Through Vocal Tract Reconstruction," in USENIX Security Symposium, 2022, pp. 2691-2708.
  44. S. Prasad, E. Bouma-Sims, A. K. Mylappan, and B. Reaves, "Who's calling? characterizing robocalls through audio and metadata analysis," in USENIX Security Symposium, 2020, pp. 397-414.
  45. Z. Yu, S. Zhai, and N. Zhang, "AntiFake:using adversarial audio to prevent unauthorized speech synthesis," in ACM SIGSAC Conference on Computer and Communications Security, ser. CCS'23, New York, NY, USA, 2023, p. 460-474.
  46. S. Jamal and H. Wimmer, "An improved transformer-based model for detecting phishing, spam, and ham: A large language model approach," arXiv:2311.04913, 2023. · arXiv
  47. J. Hazell, "Large language models can be used to effectively scale spear phishing campaigns," arXiv:2305.06972, 2023. · arXiv
  48. F. Heiding, B. Schneier, A. Vishwanath, and J. Bernstein, "Devising and detecting phishing: Large language models vs. smaller human models," arXiv:2308.12287, 2023. · arXiv

Authors
Figueiredo, J., Carvalho, A., Castro, D., Gonçalves, D., & Santos, N.
Affiliations
Instituto de Engenharia de Sistemas e Computadores Investigação e Desenvolvimento (PT)
ORCID
Venue
arXiv
Publisher
arXiv
Published
2024
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2409.13793
arXiv
2409.13793
OpenAlex
W4403752391
Cited by
1
References
0
Citations by year
2025: 1
Type
posted content
Language
en
Open access
Licence
Locations
  • arXiv (Cornell University) (submittedVersion, cc-by)
  • arXiv (Cornell University) (cc-by)
Topics
  • Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
  • Physical Sciences › Computer Science › Information Systems › Cybercrime and Law Enforcement Studies
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
Keywords
vishing, large language models, voice spoofing, speech-to-text, text-to-speech, sensitive information disclosure, social experiment, cybersecurity awareness, Vikings

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review