Vishing & phishing simulation
Would your help desk reset MFA for your CEO's voice?
Fable calls your help desk and other shared lines with an AI voice, including an authorized clone of one of your executives, and grades every call against your own verification policy. If someone goes along with the request, they find out on the call that it was a test and hear what to do next time.
Why the phone
Attackers are skipping the inbox and picking up the phone
Email filters and click-based phishing tests never see a phone call, and voice cloning has made a convincing call almost free. That's why criminal crews now call help desks, contact centers and sales teams directly, usually posing as internal IT.
442%
growth in vishing from the first to the second half of 2024, and it doubled again by the first half of 2026
CrowdStrike 2025 & 2026 reports
$100M+
in losses at MGM Resorts after a help desk MFA reset over the phone
$15M
stolen from Retool through an AI deepfake voice
How a vishing test works
01
Pick the line and the scenario
Choose a shared line, such as your IT help desk, customer support or a main corporate number, then describe the scenario or start from a template, including the caller’s persona, cover story and goal.
02
Choose the voice
Use a stock voice, or an authorized clone of one of your executives created in Fable AI Studio.
03
Fable places the call
Preview it first, then go live. The AI caller navigates your phone menu, reaches a person, and adapts naturally when they push back.
04
Teach and grade on the spot
If the person refuses, verifies, or goes along with the request, the caller reveals the test and coaches them right then. Every call lands in Fable with a full transcript and a pass, fail or inconclusive grade based on your policy.
Scenarios built from real attacks
Law firms
“IT” calls about a billing issue and asks for a quick screen share, the playbook Silent Ransom Group has used against dozens of firms.
Financial services
A cloned portfolio manager or CFO voice asks operations for an urgent wire or new banking details before a settlement cutoff.
Insurance
A caller posing as a policyholder fails a verification check, then pushes the agent to override it and reroute a payout.
Airlines and hospitality
“Vendor support” asks a contact-center agent to read back an MFA code after an outage, the pattern behind recent airline breaches.
Technology
“Internal IT” walks a sales rep through re-authorizing their Salesforce account, the same approach used against major software companies in 2025.
And the inbox, too
Phishing tests built from the attacks you actually see
Drop a real phishing email into Fable and the phishing agent turns it into a role-specific simulation that uses your company's context. Anyone who clicks, opens an attachment or enters credentials gets a follow-up briefing about that exact email, and you can track reporting rates and repeat offenders over time.
2.4x
Pennymac saw a 2.4x higher phishing reporting rate when employees received a briefing.
Beyond the shared line
Go further with deepfakes and a human red team
Show employees what a deepfake executive looks like with video training from Fable AI Studio, and bring in our expert human red team for high-stakes, hyper-targeted engagements. Both feed the same loop as every vishing and phishing test.
See proof from your peers
Dayton Children's Hospital
A targeted vishing intervention for the service desk team, plus a phishing click rate of about 2%, compared with a 15% industry average
2%
phishing click rate
A Fortune 500 software company
Identified the sales employees most exposed to voice phishing, before any attack
Vishing risk mapping
alteryx
CISO at Alteryx
Questions buyers ask
Whose voice does the AI use?
Only voices you authorize. You choose the voice during setup, and exec voice clones require that person's sign-off.
What counts as a pass or a fail?
A fail means the person goes along with the request, such as resetting MFA or sharing information. A pass means they refuse, verify, or move to an approved channel.
Are calls recorded?
Yes. Every call comes with a transcript and evidence in Fable. Recording consent rules vary by location, so you'll confirm legal sign-off before your first test.
Can it get through a phone menu?
Yes. The AI caller navigates phone trees to reach a person, and you can add menu directions for each line.
See how your help desk holds up against a cloned voice
Book time with a Fable expert, and we'll run a vishing simulation test for free on your first call.