Automated Vishing Detection via Call-Specific CAPTCHA Prompts

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The increasing prevalence of lifelike chatbots and deepfake voice simulators poses a significant threat to enterprise organizations by facilitating unauthorized access to confidential information during voice communications, necessitating enhanced security mechanisms to detect and prevent vishing attacks.

Innovation Solution

A computing platform trains a prompt generation model using historical call data to generate customized CAPTCHA-style security prompts, which are displayed to users to validate their identity, and adjusts the model dynamically based on feedback to improve detection accuracy.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If traditional voice communication security measures are used, then implementation complexity is low, but detection accuracy against deepfake and chatbot attacks is insufficient

Engineering Contradiction:

Improvedetection accuracyVSAvoidsecurity mechanism complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The patent introduces a CAPTCHA verification system as an intermediary security layer between the voice communication and the authentication mechanism. This mediator challenges potential deepfakes and chatbots by requiring completion of tasks that are difficult for AI systems to perform, thereby improving detection accuracy without requiring complete redesign of the communication infrastructure

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces traditional mechanical voice authentication with an AI-based detection system that uses machine learning models to analyze voice patterns, speech characteristics, and behavioral cues. This substitution enables more accurate detection of synthetic voices while maintaining user-friendly interaction

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If security prompts are added to validate user identity, then vishing attack prevention improves, but call duration increases

Engineering Contradiction:

Improvevishing attack preventionVSAvoidcall duration

Core Design Contradiction:

ReliabilityVSDuration of action of moving object

Solution Approach 1:

The patent implements partial verification by selecting only the most critical security prompts and CAPTCHA tasks rather than requiring comprehensive authentication. This partial action approach maintains adequate security against vishing attacks while minimizing the time added to normal calls

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

The security verification is implemented as a periodic interruption rather than continuous verification. The system pauses the call only when security prompts need to be displayed and validation is required, allowing normal communication to proceed uninterrupted during successful verification

Inventive Principle:

Principle #19Periodic action

3Measurement precision

If customized CAPTCHA tests are implemented, then detection capability improves, but system processing time increases

Engineering Contradiction:

Improvedetection capabilityVSAvoidprocessing time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent applies local quality by customizing CAPTCHA tests specifically for voice communication scenarios rather than using generic verification methods. The security prompts are tailored to the context of the call, requiring knowledge specific to the communication session, which improves detection capability while keeping processing time manageable

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The system performs preliminary actions by pre-generating and storing security prompts and CAPTCHA tasks before they are needed during actual calls. This preparation allows the system to quickly retrieve and present appropriate verification challenges without significant processing delays during the call itself

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS20250330537A1Automated vishing detection to prevent deepfake and chatbot attacks

Publication Date: 2025.10.23 BANK OF AMERICA CORP

AI summary

A computing platform may train, using historical call information, a prompt generation model to identify, for an initiated call between a first individual and a second individual, one or more security prompts to validate an identity of the first individual. The computing platform may detect and temporarily pause a call. The computing platform may input, into the prompt generation model, information of the call, which may cause the prompt generation model to output the security prompts, which may be customized CAPTCHA tests based on the information. The computing platform may send, while the call is paused and to a user device of the first individual, the security prompts. The computing platform may receive, while the call is paused and from the user device, responses to the one or more security prompts. The computing platform may validate, while the call is paused, the responses, and resume the call.