News · Academy · November 12, 2026

Academy: social engineering and the fake helpdesk call

Cloned voices make a phone call sound real. The habits that beat urgent, secret, authority pressure: call back, never share codes, verify another way.

DRIVE 369 DAO · 3 min read

Also in: Русский · 中文

Module 3 of the Academy: social engineering. This lesson is for people and small teams. It is defensive: no scripts for attacking anyone.

The old trick, with a new voice

Social engineering means getting a person, not a computer, to open the door. It works because it uses trust, hurry and fear. What changed is the voice. Reports in 2026 describe attackers calling employees while pretending to be the company helpdesk, with voices cloned from a few seconds of audio, then sending the victim to a fake sign-in page and collecting passwords and codes in real time (SC Media, The Hacker News). Some of the detailed campaign accounts come from security vendors and have not been confirmed by the companies named, so treat the specifics with care. The pattern is what matters.

Three signs

Almost every scam has all three:

1. Urgent. Something bad happens in ten minutes.
2. Secret. Do not tell anyone.
3. Authority. It is the boss, the bank, the helpdesk, the police.

When you feel all three, stop. The feeling is the signal.

Four habits

• Hang up and call back on a number you already know, not one the caller gives.
• Never read out a code, and never approve a sign-in you did not start. A real helpdesk does not ask for either.
• Verify by a second channel. If the boss asks for a payment by phone, ask in the company chat.
• Do not trust questions only the real person should know. The US standards body NIST no longer treats knowledge-based questions as secure, because the answers leak.

Why detection is not enough

Tools that detect a cloned voice exist, but vendor figures put them well short of perfect, so a procedure that does not depend on recognising a voice is safer. A call-back rule works even if the voice is perfect.

What Ghostdrive changes, and what it does not

It does not stop someone from phoning you. It does remove several things the caller would need:

• A sign-in that cannot be talked out of you. Your Ghost ID is a key on your device. There is no password to read out and no helpdesk that can reset it for a stranger. If you lose your passkey and recovery words, no one can recover your vault, so keep the words safe and tell no one.
• Identity that is proved, not claimed. In Calls, a person's Ghost ID is shown or saved only when a signed hello proves it, and a call link cannot name who invited you.
• An alert when another device opens your vault. If someone uses a stolen secret, a synced journal shows it and offers "Not me" (how it works).
• Two-factor codes you control. Pass shows the current code, and sharing a login with someone needs their Ghost ID and has an expiry.

Try it: a ten-minute drill

With your team or family, agree on one call-back rule and one code word for emergencies. Then run a pretend call: one person plays an urgent caller, the other practises hanging up and calling back. Do it once and you will remember it.

Academy: start here · Calls · Security and audits