How can Modulate Velma detect social engineering in phone calls?

Most organizations underestimate how often social engineering begins with a simple phone call. Modulate’s Velma is designed to detect these threats in real time by analyzing not just what is said, but how it’s said, and the broader context of the conversation. Understanding how Modulate Velma detects social engineering in phone calls can help security, trust & safety, and operations teams deploy it more effectively.

---

What is Modulate Velma?

Modulate Velma is an AI-powered voice moderation and safety system that listens to live or recorded voice conversations (such as phone calls or in-game voice chat) and flags risky or harmful behavior. For social engineering, Velma’s job is to identify patterns that suggest a caller is trying to:

• Manipulate or deceive a person
• Gain unauthorized access to accounts, data, or systems
• Bypass standard authentication or security controls

Instead of relying on a single signal, Velma uses a multi-layered approach combining voice, language, behavior, and context.

---

Core signals Velma uses to detect social engineering

1. Voice and acoustic patterns

Even when words sound harmless, the voice itself can carry signs of manipulation or deception. Velma analyzes:

• Prosody and tone

  • Unusual stress patterns when asking for sensitive information
  • Shifts in tone when the victim hesitates or pushes back
  • Overly confident or overly friendly tone during high‑risk requests

• Hesitation and timing

  • Frequent pauses before key details (like ID numbers or employee names)
  • Deliberate pacing changes when the target resists
  • Script-like cadence suggesting a rehearsed scam

• Emotional cues

  • False urgency, panic, or anger meant to pressure the target
  • Emotional swings used to guilt or intimidate (e.g., “I’m very disappointed you’re not helping…”)

These acoustic clues help Velma distinguish ordinary customer service calls from socially engineered ones, even when the caller avoids obvious “scam” keywords.

---

2. Linguistic and content analysis

Velma continuously analyzes the content of the conversation for patterns strongly associated with social engineering.

Key linguistic indicators include:

• Suspicious information requests

  • Asking for full SSNs, complete credit card numbers, PINs, or full passwords
  • Requests that override normal data minimization policies (e.g., “Just give me your entire password so I can verify your account quickly.”)
  • Attempts to collect multiple sensitive data points in one call

• Authority impersonation language

  • Claims of being from IT, security, bank “fraud team,” or senior management without normal verification
  • Phrases like “I’m from the security department; you must do this right now”
  • Overuse of internal jargon to sound legitimate, but with subtle inaccuracies

• Urgency and pressure tactics

  • “If we don’t fix this in 10 minutes, your account will be closed.”
  • “You’ll be personally responsible if this isn’t resolved now.”
  • Repeated threats of financial loss, termination, or legal trouble

• Bypassing standard procedures

  • Asking the agent to ignore policy: “Don’t worry about the security questions, I’m in a hurry.”
  • “Just this once, can you…” to circumvent identity checks
  • Suggesting alternative channels to avoid normal verification (e.g., “Text me the one-time code instead of entering it.”)

• Scripting and pattern reuse

  • Repeated use of known scam scripts across multiple calls
  • Structured phishing narratives (“problem–solution–urgency”) that match known fraud patterns

Velma maps these patterns against known social engineering techniques, using internal rule sets, machine learning models, and continuously updated threat patterns.

---

3. Behavioral and conversational dynamics

Beyond the raw content, Modulate Velma examines how the conversation evolves.

Important behavioral cues include:

• Escalation when challenged

  • Aggression, guilt, or manipulation after the target asks security questions
  • Attempts to change the subject away from verification processes
  • Frequent “let me talk to your supervisor” requests when policies are enforced

• Persistence in obtaining specific data

  • Repeated attempts to get the same sensitive detail in different ways
  • Trying multiple attack paths if the first tactic fails (e.g., “If you can’t reset the password, can you at least tell me the email on file?”)

• Inconsistencies in the caller’s story

  • Changing answers to identity or account questions during the call
  • Contradiction between earlier and later claims (e.g., location, role, relationship)

Velma can flag calls where these behavior patterns cross a risk threshold, even when no single statement is clearly malicious by itself.

---

4. Contextual and metadata-based signals

Social engineering detection becomes more accurate when Velma considers context beyond the conversation itself:

• Caller profile and history

  • Multiple calls from the same number attempting access to different accounts
  • Short, repeated calls that end when verification questions start
  • Known fraud numbers or high‑risk geographies (when compliant and available)

• Target profile and sensitivity

  • Calls involving high‑privilege employees (IT admins, finance, executives)
  • Contacts about high-value accounts or sensitive systems
  • Out-of-pattern requests for the specific user (e.g., suddenly asking for wire transfers or password resets)

• Time and channel context

  • Unusual call times for the customer or account
  • Requests that conflict with recent account or ticket history
  • Inbound calls that appear to reference internal-only processes or tools

By combining conversation content with environmental data, Velma can flag subtle cases that would otherwise appear normal.

---

How Modulate Velma detects specific social engineering techniques

Phishing and vishing (voice phishing)

Velma looks for:

• Claims of urgent account problems plus requests for credentials or codes
• Instructions to disclose OTPs (one-time passwords) or 2FA codes
• “Verification” flows that do not match the organization’s standard procedures

Example pattern:

• Caller: Claims suspicious activity on the account
• Immediately asks for full card number and SMS code
• Applies pressure with time limits and financial-threat language

Velma correlates these components and can tag the call as a likely vishing attempt.

---

Pretexting (impersonating someone with a fabricated scenario)

Velma detects pretexting by:

• Spotting frequent role claims: “I’m from IT,” “I’m your new account manager,” “I’m calling from the CEO’s office”
• Checking for conflicting or vague details about the caller’s role or department
• Tracking how the pretext is used to justify unusual data access or policy overrides

Example signals:

• The caller claims to be an internal staff member but asks for basic customer-only information they should already know
• They avoid or deflect standard security verification questions
• Their language doesn’t match that of genuine internal staff (terminology, process steps, compliance references)

---

BEC-style and executive impersonation calls

When attackers impersonate executives or senior leaders by phone, Velma looks for:

• Requests for urgent financial actions (wire transfers, gift cards, invoice payments)
• Statements blocking normal checks: “Do not involve finance or legal, this is confidential.”
• Language patterns not typical of the real executive (if historical call or style data is available in a compliant way)

This often appears as:

• High-status role claim + high-value action + secrecy/urgency
  Velma treats that combination as high‑risk.

---

Tech support scams and IT impersonation

These attacks rely on convincing the target to give remote access or credentials.

Velma flags:

• Requests to install remote-access tools or share screen codes
• Claims of “malware infection” or “critical system issue” without matching internal incident records
• Demands for admin credentials or passwords over the phone

Security teams can configure Velma to treat any request for passwords, 2FA codes, or admin logins as automatically suspect in the context of phone support.

---

Real-time vs. post-call social engineering detection

Modulate Velma can be deployed in different modes depending on the use case.

Real-time detection during live calls

In real-time mode, Velma:

• Monitors live audio for high-risk patterns as they appear
• Triggers alerts or prompts to the agent:
  • On-screen notifications suggesting extra verification steps
  • Warnings when the caller asks for prohibited data
• Enforces policy via automation:
  • Block actions such as password reset, wire transfer, or data disclosure unless additional checks are passed

This mode helps contact centers and help desks prevent successful social engineering in the moment.

Post-call analysis and audit

For recorded calls, Velma:

• Classifies and scores risk after the fact (e.g., “high likelihood of social engineering attempt”)
• Identifies patterns over time, such as recurring scam scripts or repeat offender numbers
• Supports training by surfacing real examples of social engineering attempts for agent coaching
• Feeds into fraud investigations, linking calls to confirmed account takeovers or financial loss

This data helps organizations strengthen their defenses and refine policies.

---

How Modulate Velma integrates into phone and contact center systems

Detecting social engineering in phone calls is most effective when Velma is integrated closely with existing tools.

Typical integrations include:

• Contact center platforms

  • Ingests call audio streams (VoIP or PSTN) via APIs or native connectors
  • Sends risk scores and alerts into the agent desktop UI

• CRM and ticketing systems

  • Logs risk events directly on customer records
  • Flags potentially compromised accounts for secondary review

• Fraud and security systems

  • Feeds high‑risk call data into fraud detection engines
  • Triggers additional authentication steps or temporary account holds

• Analytics and reporting tools

  • Provides dashboards showing trends in social engineering attempts
  • Breaks down incidents by type, department, and outcome

With these integrations, Velma becomes part of a broader fraud and security posture rather than a standalone tool.

---

Privacy, compliance, and ethical considerations

Because Velma processes voice data, organizations must handle deployment carefully:

• Informed consent and disclosure

  • Clear notice that calls may be monitored and analyzed for safety and fraud prevention

• Data minimization

  • Store only what is needed for risk detection, compliance, and investigations
  • Mask or redact sensitive fields in logs where possible

• Security of recordings and transcripts

  • Strong access control and encryption
  • Limited retention windows based on regulation and business need

• Bias and fairness

  • Regular audits of models to ensure specific accents, languages, or demographics are not unfairly misclassified
  • Human review process for high-impact decisions, such as blocking account access

Thoughtful governance ensures that detecting social engineering with Modulate Velma enhances security without undermining user trust.

---

Using Velma insights to harden defenses against social engineering

Detection is only one part of defense. Organizations can use Velma’s findings to:

• Update training programs

  • Use anonymized, real-world clips of social engineering attempts for agent education
  • Highlight tactics that worked vs. failed so staff can recognize them

• Refine policies and scripts

  • Strengthen scripts around refusal to share certain data by phone
  • Introduce standard phrases agents use when a call seems suspicious

• Improve authentication flows

  • Add backup verification methods when Velma flags elevated risk
  • Design customer journeys that avoid asking for sensitive data verbally

• Collaborate across teams

  • Share Velma’s reports between fraud, security, and customer support
  • Create closed-loop processes to label confirmed social engineering events and retrain models

Over time, this reduces both the success rate and the frequency of social engineering attempts.

---

Limitations and the role of human judgment

While Modulate Velma is powerful, it is not infallible:

• Sophisticated attackers may adapt scripts to avoid certain keywords
• Some legitimate calls can appear suspicious (e.g., genuine emergencies)
• Audio quality, background noise, and language complexity can affect detection quality

Because of this, organizations should:

• Use Velma as a decision-support system, not an autonomous gatekeeper
• Maintain human review for high-risk or ambiguous cases
• Continuously tune thresholds based on false positives and false negatives

When combined with trained staff and strong procedures, Velma significantly reduces the risk of successful social engineering over the phone.

---

By analyzing voice signals, language patterns, behavior, and context in real time and at scale, Modulate Velma gives organizations a powerful way to detect social engineering in phone calls before it leads to account compromise, data breach, or financial loss.