Blog: Security
Vishing examples: seven phone scam scripts and the red flag in each
By the TelecomsXChange engineering team ยท
These vishing examples are seven phone scam scripts from the labelled set we use to test call analysis: the opening lines, the moment each one asks for the thing it came for, and how an analyzer on the phone line scores it. The scripts are synthetic and written from real patterns, and they follow the same shapes your reception desk hears.
The scripts
Seven calls, seven asks
1. "The fraud department at Card Services"
"Good morning, this is Andrew Martin with the fraud department at Card Services. We flagged a purchase of four hundred and ninety-nine dollars at an electronics store this morning. Was that you?" It was not, and the relief of being protected is the hook. To "cancel the charge" he needs the card number, the expiry and the three digits on the back, and the line has to stay open for five minutes or the charge will post.
Red flag: a caller asking for the card number and security code. No issuer needs them, because it already has them. Scored: credit card scam, block, in the mid-nineties.
2. "The Microsoft Windows technical department"
"I am calling from the Microsoft Windows technical department. Your computer has been sending error reports; hackers are using your IP address." The infection is hidden, which is why the person has not noticed. The fix needs remote access, and then a "cleaning fee" paid in gift cards, read out over the phone.
Red flag: remote-access instructions and a fee in gift cards. Scored: tech-support scam, block.
3. "Officer Daniel Reyes, badge 4172, Internal Revenue Service"
"An arrest warrant has been issued in your name for a tax debt of six thousand two hundred dollars. The letters were returned." Settlement is possible today, in prepaid cards, and hanging up will be treated as refusal. A badge number is read out for authority.
Red flag: a threat with a same-day deadline and payment in gift cards. Scored: government impersonation, block, the highest band.
4. "Michael from the Chase fraud prevention team"
"Two wire transfers to Mexico totalling three thousand eight hundred dollars. To freeze the account I need to verify you: please read me the code we just sent." The caller ID shows the bank's own number. The code is the one-time passcode for the person's online banking, and the "verification" is the login.
Red flag: a request for a one-time code. The code is the key, and the bank never asks for it. Scored: bank impersonation, block.
5. "Rachel from the Medicare enrolment centre"
"We are sending out the new chip cards; your paper card is being deactivated at the end of the month." To issue the new one she needs the Medicare number, the date of birth, and the bank account the benefits go to, "to confirm it is still yours".
Red flag: collecting an ID number, date of birth and bank details on a call the agency placed. Scored: government impersonation, block.
6. "Grandma, it's me. I'm in trouble."
"I broke my nose in a car accident, that's why I sound different. Please don't tell Mom." Then a "public defender" takes the phone: bail is needed in cash today, a courier will collect it, and the case is sealed so nobody else can be told.
Red flag: secrecy plus a courier for cash. Real emergencies do not need silence. Scored: block, on the request for money and the secrecy demand.
7. "Congratulations! This is David from the prize department."
"Two and a half million dollars and a Mercedes. Everyone with a phone was entered automatically." Before delivery there is a tax and insurance fee of nine hundred and eighty dollars, payable today, and the prize is forfeited tomorrow.
Red flag: a fee to receive a prize. Scored: prize scam, block.
The shape
Different words, one pattern
Every script above is three things: an impersonated authority (a bank, an agency, a company, a relative), a request for value (a code, a card, a password, access, cash, a gift card) and urgency (a deadline, a threat, a secret). The wording changes with the season, but the shape stays the same. That is why a person's judgment under pressure is a poor control and why a reader of the conversation is a good one. Open Voice Shield transcribes each call and scores it for this shape, with the red flag quoted from the call, and a block verdict requires the hard sign, a request for money, cards or codes, a threat, a deadline, impersonation or remote access. A polite call with none of those scores low, however unfamiliar the company.
Try it on the scam sample: a test call plays a known card-services script through your route and comes back with the verdict, the red flags and the transcript. Start free with $5 credit, or read how the detection works.
Had one of these calls and already said too much? What to do in the next hour. Want the rules that stop the next one? How to prevent vishing.
Questions
Frequently asked questions
What are common examples of vishing?
A caller from the bank's or card issuer's fraud desk verifying a purchase and asking for the card number and security code; an IT or Microsoft technician asking for remote access to fix an infection; a government officer threatening arrest over a tax debt payable by gift card; a bank security team asking for the online-banking password and the one-time code; a Medicare or benefits office issuing a new card and collecting the ID and bank details; a grandchild in trouble needing bail money kept secret; a prize department needing a fee before delivery.
What is the red flag in a vishing call?
A request for something of value under pressure: a card number, a security code, a one-time code, a password, remote access, a payment or a gift card, from a caller who claims to be an institution and gives a reason it cannot wait. Legitimate institutions do not ask for codes or passwords on a call they placed, and they do not take gift cards.
Do vishing calls all sound the same?
The words differ but the shape stays the same: an impersonated authority, a request for money, credentials, codes or access, and urgency, a deadline, a threat or a secret. Detection that reads the conversation looks for the shape, so a new script with new wording still scores as what it is.
Are these transcripts from real victims?
No. They are synthetic scripts written from the patterns real scams follow, part of the labelled set Open Voice Shield uses to compare analysis models. Real calls are not published. The set is small and written by us, so it ranks models. It is not an accuracy claim.