Voice phishing calls forecasted for specific harm trajectories early
Vishing-Tactics-Bench: Forecasting Exploitation Trajectories in Voice Phishing Calls
Computation and Language
Summary
Voice phishing scams happen in real time, so by the time a call ends, it’s often too late to prevent harm. The authors created a way to predict during a call whether the scammer is aiming to gather information or to steal money. They built a tool using labeled fake Chinese scam calls and tested different models to see how well they could forecast these outcomes as the call progresses. This prediction can help decide when and how to intervene before serious damage occurs.
What this means in practice
- •For call center security teams: Detect in-progress voice phishing calls and predict whether they aim for information or money to guide timely interventions.
- •For financial fraud prevention teams: Provide early warnings in phone scams about the likely type of harm, allowing targeted responses to reduce losses.
- •For telecommunications fraud detection vendors: Build products that forecast scam tactics and harms during calls to improve real-time fraud blocking and customer protection.$Commercial implications: Enables new real-time vishing threat detection software sold to telecom and security providers.
Authors
Jeongmin Lee, Dongmyung Sul, Seung Yun, Jinxia Huang
Abstract
Voice phishing (vishing) unfolds in real time; by the time a call has ended and post-hoc classification is possible, the harm has already been done. The more actionable question is which concrete harm (Information Gathering or Financial Exploitation) an ongoing call is tactically progressing toward. We present Vishing-Tactics-Bench, a benchmark grounded in Endsley's situation-awareness (SA) framework that recasts vishing defense from after-the-fact fraud classification to harm projection: predicting at each turn whether the call will reach either terminal harm. We adapt MITRE ATT&CK to vishing as a 6-tactic taxonomy (Vishing-Tactics) and label 35,340 scammer utterances across 5,645 synthetic Chinese calls. We define Exploitation Trajectory Forecasting, a survival-style protocol over the two terminal harms with three metrics: AP@k, C-index, and divergence error. Baselines ranging from a Markov heuristic to fine-tuned LLMs show that the tactical trajectory serves as an interpretable representation of the call's tactical state, supporting harm-specific forecasting, which can then be used for the downstream application of intervention selection; a stratified lead-time analysis at a tight false-alarm budget further identifies at what point in a call the trajectory signal yields early warning.