Evaluating AI Models' Capability to Automate Voice Phishing Attacks
Fred Heiding, Claudio Mayrink Verdun, Simon Lermen, Andrew Kao, Vitor Albiero, Lauren Deason, Irina-Elena Veliche, Christine Lehane
cs.CR, cs.CY
Submitted: 2026-08-20
Updated: 2026-08-21
Comments: Accepted for publication in Expert Systems with Applications
License: http://creativecommons.org/licenses/by-nc-nd/4.0/
The gist: Voice phishing (vishing) attacks have traditionally been limited by the need for human operators.
Terminology
Abstract
Voice phishing (vishing) attacks have traditionally been limited by the need for human operators. The rapid emergence of high-quality AI voice synthesis and large language models (LLMs) reduces this bottleneck and enables scalable, automated scams. In this paper, we conduct a large-scale survey experiment (N=4100) and qualitative interviews (N=12) to assess U.S. adults' susceptibility to AI-powered voice phishing attacks. Participants were exposed to audio recordings or transcripts of scam scenarios generated using leading voice models such as Llama Full Duplex (Llama FD), Sesame, Gemini, OAI AVM, Play. AI, and ElevenLabs and the corresponding human baselines. The results show high compliance rates. Up to 36% of participants would or might comply with phishing requests in the "relative-in-distress" category. Overall compliance rate across all five scam categories was 16.5%, a striking figure given the low cost and high scalability of AI-automated voice phishing. Caller persuasiveness was the strongest predictor of compliance and certain models (most notably Sesame) achieved ratings comparable to human voices, or sometimes even slightly surpassing them. Our economic analysis suggests that while human-operated vishing is unprofitable at US wages, AI-powered vishing appears to be economically viable for several models. The primary risk of present-day AI-enabled vishing thus lies in the economics of automation rather than novel or "superhuman" persuasive techniques, though these cannot be ruled out for future systems. This raises significant concerns for the design of AI systems, consumer protection, and model release policies.
Sources
- Can You Tell It's AI? Human Perception of Synthetic Voices in Vishing Scenarios
- LLMs unlock new paths to monetizing exploits
- On the Feasibility of Fully AI-automated Vishing Attacks
- Talking Like a Phisher: LLM-Based Attacks on Voice Phishing Classifiers
- A Preliminary Exploration with GPT-4o Voice Mode
- Gemini: A Family of Highly Capable Multimodal Models
- Beyond Turn-Based Interfaces: Synchronous LLMs as Full-Duplex Dialogue Agents
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills
- Token Composition: A Graph Based on EVM Logs