An anti-vishing solution for small and medium businesses

A scammer does not have to break in when a person will open the door. The call sounds like the bank's fraud desk asking to "verify" a card, the IT help desk needing the code that just arrived by text, a supplier whose bank account "changed" this morning, or the owner, travelling, who needs a payment made before noon. Each script is rehearsed, calm and urgent, and each one ends with a member of staff handing over credentials, a one-time code or a transfer, believing they helped.

Email has filters, link scanning and a report button. The website has a firewall. The database has encryption and access logs. The phone line has none of that. Nothing records what was said, scores it or raises an alert, and often nobody remembers more than "someone from the bank called". Texting is the same attack in another channel, and the two are often combined: a text to warn you the call is coming, then the call. For the text half we build OpenTextShield, an open-source SMS phishing and spam detection model that runs on your own servers or anywhere you choose. This post is about the call.

New to the term? What vishing is, and how it works. The Canadian Centre for Cyber Security describes the attack, its common scripts and how to recover in its guidance What is voice phishing (vishing)? ITSAP.00.102. Its section on STIR/SHAKEN explains the caller-ID authentication the CRTC has required since 2021. That protection stops at the signalling. It can tell a carrier that a caller ID was not forged, but it never hears the call. A scammer with a legitimately obtained number passes it, and so does the "IT help desk" calling from a real mobile. The attack happens in the conversation, and nothing was checking the conversation.

Open Voice Shield was built for voice operators who route millions of calls. The same hop works for a business with twenty phones, because the problem is the same: a conversation nobody could review.

Caller-ID spam filters and "scam likely" labels judge a call before it is answered, from the number alone. Vishing protection for a business has to judge the conversation, because the number is often real and the person answering is the target. Four things make a solution worth the name:

1. Detection from what was said, on every call in or out, not a reputation score on the caller ID.
2. An alert a person will see, within minutes, with the reason quoted from the call.
3. Prevention of the next attempt: the flagged number's next call is blocked or diverted without anyone having to act.
4. Evidence that survives the incident: recording, transcript, report, and a way to share them with the bank, the insurer or the police.

The platform is one SIP hop between your phone system and your carrier. A call passes through it live, untouched, and after the hangup an analysis pipeline reads it:

• A verdict within minutes. A fraud probability from 0 to 100, the category (bank or card fraud, government or IT impersonation, supplier payment redirection, pressure sales, robocall), the entity the caller claimed to be, and a recommendation: block, review or allow.
• Red flags that quote the call. Numbered, in the caller's own words: "asked for the six-digit code that was just sent", "new bank details, must be paid today". A person can read them in ten seconds.
• An alert where your team already is. E-mail, Slack, or a signed webhook into your ticketing or SIEM, above the threshold you choose.
• The next call stopped. An automation rule puts a flagged number under control: its next call is refused or diverted to a voicemail, a security line or an AI agent, for an hour, a week or for good. Numbers can be released at any time.
• Evidence that holds up. The stereo recording with each party on its own channel, the timed transcript, the SIP log, a PDF report, and a share link with a password and an expiry for the bank, the insurer or the police.

Outbound calls get the same treatment. A staff member calling back a number from a voicemail, or someone a scammer has already talked into dialling "the fraud line", places an outbound call, and it is scored too.

Whatever your phone system is, it reaches the world through a SIP trunk: a hosted PBX, an on-premises PBX, a cloud phone system with a trunk option, or a session border controller in front of Teams. That trunk points at your carrier today. With Open Voice Shield it points at the platform, and the platform forwards to the carrier. Inbound, the carrier delivers your numbers to the platform, and the platform forwards to your phone system. Phones, extensions, numbers and call flows stay as they are.

Three ways to connect

1. You run the PBX or the SBC. Add Open Voice Shield as the trunk your system sends calls to, and add your PBX as the destination on the platform. Your carrier points your numbers at the platform for inbound. It takes about half an hour and one change on each side.
2. A hosted phone system with a trunk option. Most cloud PBX products let you bring your own SIP trunk. Bring the platform as that trunk, and make your carrier the platform's destination.
3. Your provider does it for you. Ask your telecom or security provider to route your line through Open Voice Shield. Providers that partner with us switch it on per client without touching the client's equipment.

Not sure which you are? Send us the name of your phone system and your carrier and we will tell you which of the three applies, and what to type. The connection guides cover the common systems.

Managed security providers, IT firms and telecom resellers already sell email security, endpoint protection and awareness training to law firms, clinics, accountants, non-profits and local government. The phone line is the channel their clients still ask about after an incident. Open Voice Shield partners add it as a line item:

• Per-client routing by dialled prefix or source address, so many clients share one connection to the platform and each sees only their own calls.
• Alerts into your SOC: signed webhooks, Slack, e-mail, and a REST API and MCP server so your tooling or your AI agents read verdicts and evidence directly.
• Evidence you can hand over: the PDF report, the recording and the transcript per call, plus a case per caller, for the incident file.
• Prepaid, per analyzed minute plus one fee per call, no seats and no minimum, so a client can start at a fraction of their existing security spend. Data stays in Canada by default, or the United States per account.

Texting is the same attack in another channel. Open Voice Shield covers voice, and OpenTextShield, our open-source SMS phishing and spam detection model, covers messaging and can be deployed on your own infrastructure or anywhere you run it. With the email protection you already provide, the three close the social-engineering gap for a client. Talk to us about adding it to your portfolio.

Cost. Pay as you go: $0.02 per analyzed minute plus $0.02 per call on the default tier, so a three-minute call is $0.08 with the recording, transcript, verdict and report included. Signup carries $5 of credit. Route only the lines that matter, reception and finance for instance, or analyze a sample of the rest.

Consent. A business may record its own calls when it tells the parties. Put a short recording notice on inbound lines and have staff say it on outbound calls. You set the retention window. Recordings are deleted on that schedule and the platform keeps an audit log of who opened what. Read a word to operators about consent.

Staff. Tell them the line is checked, and that a verdict reaching them after a call is not a judgment on them. The aim is that the second attempt fails and that nobody has to remember what "the bank" said, because it is written down. For the habits that stop the first attempt, the Cyber Centre's tips for spotting and avoiding vishing fit on one page. The one to pin up is "hang up and call back using a known, trusted number".

Ready to try it on one line? Start free with $5 credit, read getting started, or watch the six-minute tour.