Social engineering An authorized attack simulation reveals weaknesses in customer service
Partner project by Innowise
Project profile
- CustomerNot named
- PartnerInnowise
- IndustryFinancial services
Challenge
A large financial company wanted to test how well its customer service recognizes attempts at deception by telephone. Identity verification and the handling of customer identifiers were of particular interest. Existing safeguards were to be examined under realistic conditions agreed with the client.
Solution
A simulation across several shifts
Innowise developed suitable vishing scenarios and examined a call center number provided by the client across different shifts. The test comprised more than 300 calls.
Turning findings into safeguards
The assessment uncovered gaps in procedures and in the handling of customer identifiers. A results report consolidated the findings and recommendations on identity verification and on additional safeguards. This public description shows the assessment method, not operational attack scripts.
From an approved test to a safeguard
Agreed tests: Call center scenarios → Service contact: Several shifts; Service contact: Several shifts → Observed gaps: Identity / procedures; Observed gaps: Identity / procedures → Results report: Prioritized findings; Results report: Prioritized findings → Client measures: Strengthen safeguards.
Technologies
- GoPhish / SET
- Asterisk / Twilio
- MITRE ATT&CK / NIST SP 800-115
Results
Innowise documented three significant weaknesses. According to the partner documentation, the client used the findings to close gaps and strengthen safeguards. No success rate is given, because the source states only approximate volumes for the test calls.
- Three significant weaknesses identified
- Assessment across shifts
- Concrete recommendations on identity verification
Project profile
- CustomerNot named
- PartnerInnowise
- IndustryFinancial services
Technologies
- GoPhish / SET
- Asterisk / Twilio
- MITRE ATT&CK / NIST SP 800-115
