Learning to deceive: attacker skill acquisition in a vishing simulation study

Purpose Social engineering remains a major threat to information security, not due to technical skill but by exploiting human behavior. While research has examined user susceptibility and awareness training, less is known about how attackers develop skills in real-world contexts. This study follows a beginner conducting vishing calls in the Austrian healthcare system. Design/methodology/approach Using a predefined script and anticipated responses, a novice attacker made 20 phone-based attempts to persuade staff to visit a fake internal web page and read a short code aloud, simulating a minor breach. Over time, the attacker progressed from hesitant reading to confident improvisation, adjusting to feedback in real time. Findings Targets were often friendly and unresisting, reinforcing the attacker’s confidence. With practice, the attacker refined their approach quickly, demonstrating how ordinary workplace interactions can serve as inadvertent training grounds. Research limitations/implications The study was small, involved a single institution and one attacker, limiting generalizability. Nonetheless, consistent observations offer useful ideas for larger studies and understanding attacker behavior. Practical implications High-trust environments like healthcare need not only training but also structural changes encouraging polite skepticism, verification of unexpected requests and active questioning. Everyday norms of helpfulness and trust can unintentionally enable attackers to learn and improve. Originality/value While vishing effects on organizations are documented, the attacker’s perspective is rarely studied. Focusing on skill development provides new insight into how quickly attackers improve in real-world settings.