I take a sip of my coffee and put on my headset, I’m ready to start my workday. A large portion of my work consists of making vishing (voice phishing) calls, where we test our clients’ employees. I look at my pretext notes and take a deep breath as I get into character to play the alias for that particular client. As I dial the number, I hear the familiar hold music. This time however, I was surprised when the agent answered the phone for they answered in Spanish…the language of my heart. What you may not know is, I was born in Spain. Even though I am Spanish, for just a split second I was speechless when the pretext met reality.
Say Something
During the milliseconds of silence, I kept telling myself “Just say something.” I continued with my pretext in English, thankfully the agent swiftly responded in English. After a sigh of relief, I was back to feeling empowered again. After the call I asked myself: what happened? Why did I stall? Afterall, Spanish is my first language, why did I not feel comfortable switching to Spanish? I let those questions float in the back of my mind unanswered. I figured, somehow, I may have pressed the Spanish option by mistake, no big deal.
I continued to the next call. There was the hold music again, another sip of coffee and then the agent answered again in Spanish! I thought “What is going on? Did I press the “para Español” option?” By the third call, I realized that we were calling a Spanish speaking customer service desk. Although the agents I had spoken to were able to switch to English, it was difficult for them to fully understand the entire conversation. I had quite a few of these calls to make. I had to decide to either continue to do all of them in English or switch to Spanish.
Embrace Discomfort
Ironically, the easiest thing for me to do would be to continue making the calls in English. I say “ironically” because I didn’t learn English until I was 13 years old and struggled to master the language. Now I use English for work every day so it’s second nature to do vishing in English. Spanish is reserved for my family and close friends. I realized that speaking Spanish for me is closely related to feelings of warmth and emotional intimacy whereas English is my “business” language. While operating in English, I can distance my feelings at any given time thus making it easier to get in and out of character for each pretext. Additionally, it would feel uncomfortable to make these calls in Spanish because I only know the industry’s jargon in English. I wondered, “como se dice ‘update’ in Spanish?”
I decided to embrace the discomfort and make the rest of the calls in Spanish. To that end, I looked up all the unfamiliar terms and translated the pretext. It took me a couple of calls to get comfortable. I thought as soon as the agents heard me speaking their language that I would have automatic rapport. That was not the case.
A Learning Experience
The Spanish speaking employees seemed friendlier when I spoke their language, however that did not change their verification procedure. Most of the employees that I spoke to that day were very diligent in verifying me before giving out any information. The lesson: well-trained employees that know how to follow their corporation’s verification procedures are more likely to be secure. Having the opportunity to vish in Spanish was a definitely learning experience.
At Social-Engineer LLC All our vishing calls are made by professionally trained, certified social engineers. We pivot and adjust our conversations like a real attacker while sticking to our code of ethics. By doing this, we create a lasting learning experience to benefit our client company and their employees when they learn to protect their sensitive information from malicious attackers.
Written by Rosa Rowles
Human Risk Analyst
Social-Engineer, LLC