Voice phishing calls tracked to predict scams before damage happens
Vishing-Tactics-Bench: Forecasting Exploitation Trajectories in Voice Phishing Calls
Computation and Language
Summary
Voice phishing scams happen during phone calls in real time, making it hard to stop harm once the call ends. The authors created a new way to predict whether a scam call will try to steal information or money while the call is happening. They analyzed thousands of scammer statements from fake calls and grouped their tactics into six types to better understand the scam’s progress. Their system aims to spot the danger early so that the call can be stopped before real harm occurs. This work could help law enforcement or phone companies intervene during suspicious calls.
voice phishingsituation awarenessexploitation trajectoryMITRE ATT&CKsurvival analysiscall interceptionharm projectiondata labelinglarge language modelsfalse alarm rate
Authors
Jeongmin Lee, Dongmyung Sul, Seung Yun, Jinxia Huang
Abstract
Voice phishing (vishing) unfolds in real time; by the time a call has ended and post-hoc classification is possible, the harm has already been done. The more actionable question is which concrete harm (Information Gathering or Financial Exploitation) an ongoing call is tactically progressing toward. We present Vishing-Tactics-Bench, a benchmark grounded in Endsley's situation-awareness (SA) framework that recasts vishing defense from after-the-fact fraud classification to harm projection: predicting at each turn whether the call will reach either terminal harm. We adapt MITRE ATT&CK to vishing as a 6-tactic taxonomy (Vishing-Tactics) and label 35,340 scammer utterances across 5,645 synthetic Chinese calls. We define Exploitation Trajectory Forecasting, a survival-style protocol over the two terminal harms with three metrics: AP@k, C-index, and divergence error. Baselines ranging from a Markov heuristic to fine-tuned LLMs show that the tactical trajectory serves as an interpretable representation of the call's tactical state, supporting harm-specific forecasting, which can then be used for the downstream application of intervention selection; a stratified lead-time analysis at a tight false-alarm budget further identifies at what point in a call the trajectory signal yields early warning.