Loading…
SE Against Humans
Classic social engineering techniques adapted specifically for phone-based attacks against call center agents, customer service reps, and support staff.
Attack Types
The most common social engineering techniques used against call center agents. Each exploits different psychological pressure points — and they're often combined in a single attack.
Pretexting / Impersonation
Impersonating customers, executives, vendors, or IT staff to gain account access or sensitive information. The attacker builds a complete false identity — name, role, backstory — and uses it to establish credibility before making their real request. Effective pretexts are researched in advance using LinkedIn, company websites, and data breaches to make the story airtight.
Vishing with Voice Cloning
Using AI-cloned voices of known individuals (CEO, family members, coworkers) to add credibility to social engineering calls. With as little as 5-10 seconds of audio from a voicemail, YouTube video, or social media, an attacker can generate a convincing voice clone. When the target hears a familiar voice, they bypass their normal skepticism entirely.
Authority Exploitation
Claiming to be from management, legal, compliance, or law enforcement to bypass security procedures. The attacker leverages the target's instinct to defer to authority figures. Phrases like "I'm calling from the CEO's office" or "This is a compliance audit" trigger a deference response that overrides training — especially when combined with urgency.
Emotional Manipulation
Using anger, tears, panic, or sympathy to pressure agents into skipping verification steps. Angry callers make agents want to de-escalate quickly. Crying callers trigger empathy that overrides procedure. Panicked callers create urgency. The emotional state becomes the attack vector — the agent's desire to help or resolve conflict becomes the vulnerability.
Multi-Channel Coordination
Combining phone, email, and chat attacks simultaneously to create a convincing narrative. An attacker sends a spoofed email "from the CFO" requesting a wire transfer, then calls the target pretending to be the CFO's assistant to follow up. Each channel reinforces the others — the phone call validates the email, and the email validates the phone call.
Scenario: The Angry Executive
An attacker calls a bank's call center pretending to be a high-value client's executive assistant.
Attacker
Hi, I'm calling on behalf of Robert Chen, your premier client. He's in a board meeting right now and is absolutely furious.
Establishing authority + creating urgency
Scenario: The Sympathetic Caller
An attacker calls a telecom company pretending to be a domestic abuse victim trying to separate their account.
Attacker
(speaking softly, emotional) Hi... I need help. I'm trying to separate my phone account from my husband's. I had to leave suddenly and I... I don't have the account PIN because he controlled everything.
Creating sympathy + plausible scenario that explains lack of credentials
Common Pretexting Personas
Pretexting is the art of creating a fabricated scenario to extract information. These are the most common identities attackers assume when targeting call centers — each designed to exploit a different trust relationship.
IT Support / Helpdesk
Goal: Get credentials, install remote access.
The attacker poses as internal IT, often claiming there's an urgent security issue or system update. They ask for passwords, request remote desktop access, or direct the target to install software. This works because employees are conditioned to cooperate with IT and rarely verify that the caller is actually from the department.
Red Flags:
Asks for passwords (real IT never does)
wants to install software remotely
creates urgency around a "security incident" you haven't heard about.
New Employee
Goal: Get internal information and processes.
The attacker pretends to be recently hired and "still learning the ropes." They ask seemingly innocent questions about internal systems, procedures, org structure, and tools — information that helps them plan a more targeted attack later. People naturally want to help new colleagues.
Red Flags:
Asks overly specific questions about systems they wouldn't need access to
can't provide employee ID or manager name when pressed
contacts multiple departments with similar questions.
Vendor / Contractor
Goal: Access systems or gain physical entry.
The attacker claims to be from a known vendor or contracted service provider. They name-drop real employees or reference real projects to build credibility, then request access to systems, data, or facilities. Companies work with so many vendors that it's hard to verify every one.
Red Flags:
Name-drops but can't verify contract details
doesn't have a valid purchase order or ticket number
pushes back when asked to go through procurement.
Law Enforcement
Goal: Get customer data without a warrant.
The attacker impersonates a police officer, FBI agent, or other authority figure demanding immediate access to customer records for an "active investigation." They rely on the target's instinct to defer to law enforcement and fear of obstructing justice.
Red Flags:
Demands urgency and avoids formal legal channels
won't provide a case number or subpoena
threatens consequences for non-compliance
calls directly instead of going through the legal department.
Executive Assistant
Goal: Wire transfers or account changes.
The attacker claims to be calling on behalf of a C-level executive who is "in a meeting" or "traveling" and can't call themselves. The request is always urgent — a wire transfer, an account update, or access to sensitive data. The executive's unavailability conveniently prevents verification.
Red Flags:
The executive is always unavailable for callback
extreme time pressure on financial transactions
requests bypass normal approval workflows
provides partial account details obtained from breaches.
Fellow Employee (spoofed)
Goal: Internal transfers or policy overrides.
The attacker spoofs the caller ID to show an internal extension or a known employee's number, then requests internal transfers, policy exceptions, or sensitive information. The spoofed number provides instant false credibility.
Red Flags:
Caller ID shows internal number but voice is unfamiliar
unusual requests that don't match the supposed caller's role
can't answer personal questions a real colleague would know
requests that bypass normal approval chains.
Check Your Understanding
Question 1 / 4
In "The Sympathetic Caller" scenario, why is emotional manipulation one of the hardest attacks to defend against?