> For the complete documentation index, see [llms.txt](https://herd-security.gitbook.io/herd-security-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://herd-security.gitbook.io/herd-security-docs/simulations/voice-simulations.md).

# Voice Simulations

Run AI voice phishing (vishing) simulations that call your team with a realistic pretext, and see who reads a verification code back to a stranger.

## Overview

Voice phishing — **vishing** — is the phone call version of everything your team already practices by email and text. A caller claiming to be the help desk, the CFO, or payroll creates urgency and asks for one small thing: the code that just arrived on your phone. Attackers use AI voices to do this at scale, and it works because a live conversation gives people no time to think.

Herd lets you run that exercise safely. A voice simulation pairs a text message with a phone call:

1. The person receives a **text message with a code** in it.
2. Then their phone rings. An **AI voice plays the pretext** from the attack type you chose — the help desk confirming a ticket, finance releasing a payment, payroll checking a direct deposit change.
3. The caller asks them to **read the code back**.

What they do next is the result:

* **Reading the code back is a fail.** They handed a verification code to someone who called them out of the blue.
* **Answering the call without reading the code back is a pass**, and so is **not answering at all**.

Each person's outcome is recorded on the campaign's **Results** tab, so voice sits alongside your email, SMS, and WhatsApp simulations as one more channel your team practices on. Reading the code back is recorded as a failure and raises a **high-weight risk event** on that person's profile.

***

## What people hear

Calls open with a **disclosure**, played in **Herd's own voice** (at 1.2x speed) before the pretext begins, so it never sounds like the caller:

> This is a security awareness exercise run by your employer. No account or payment is affected, and the code you were sent is not a real verification code.

Only after that does the AI voice start the scenario. Herd pre-fills that line on every attack type — see [Voice Attack Types](/herd-security-docs/simulations/voice-simulations/attack-types.md#the-disclosure-line).

{% hint style="info" %}
**The code is not real.** It doesn't unlock anything, it isn't tied to an account, and reading it out loud can't affect a login, a payment, or a payroll record. It exists only so the simulation can tell whether someone would have given a real one away.
{% endhint %}

{% hint style="info" %}
**No call audio is kept.** Herd stores only the digits the speech recognizer heard, not a recording of the conversation.
{% endhint %}

{% hint style="success" %}
**People who opted out of texts are never called.** Anyone who has opted out of simulation text messages is excluded from voice campaigns automatically — you don't have to maintain a list.
{% endhint %}

***

## What You'll Find Here

* [**Before You Start with Voice Simulations**](/herd-security-docs/simulations/voice-simulations/before-you-start.md): what has to be in place before your first campaign can launch — the channel, the consent attestation, and phone numbers.
* [**Voice Attack Types**](/herd-security-docs/simulations/voice-simulations/attack-types.md): the four built-in scenarios, how to write your own, and how attack-type approval works.
* [**Create & Launch a Voice Campaign**](/herd-security-docs/simulations/voice-simulations/create-and-launch-a-campaign.md): pick an attack type, build the audience, choose when to call, and launch.
* [**Voice Campaign Results**](/herd-security-docs/simulations/voice-simulations/campaign-results.md): what each status means, per-person call history, and why a scheduled launch might not have called anyone.
* [**Managing Voice Campaigns**](/herd-security-docs/simulations/voice-simulations/managing-campaigns.md): unscheduling, duplicating, renaming, and what happens when consent is withdrawn.
* [**Voice Simulation Limits**](/herd-security-docs/simulations/voice-simulations/limits.md): where voice simulations work and where they don't.

***

Pair voice with [email](/herd-security-docs/simulations/phishing-simulations.md), [SMS](/herd-security-docs/simulations/sms-phishing-smishing-simulations.md), and [WhatsApp](/herd-security-docs/simulations/whatsapp-phishing-simulations.md) campaigns so your team practices on every channel an attacker will actually use.