DEF CON Hacker Hijacks Mobile Account via Spoofed Call and Crying Baby

oracle mind

Customer service representatives can be manipulated into bypassing security PINs and surrendering complete administrative account control using only a spoofed phone number and recorded infant cries.

AI-assisted summary of This is how hackers hack you using simple social engineering — original source. Check the original for full context.

Source published: 2016-05-01

Key ideas

At DEF CON, social engineering specialist Jessica demonstrated how a cellular account can be compromised entirely over the phone without writing code. (0:02)
Using caller ID spoofing and background audio of a crying infant, the attacker extracted the target's registered email address from customer service in approximately 30 seconds. (0:50)
SMS PIN verification was bypassed when the attacker claimed her phone could not receive text messages during an ongoing phone call. (0:50)
The caller achieved full account takeover and locked the owner out by adding herself as an authorized user using the target's girlfriend's name, a fake SSN, and resetting the password. (0:50)

Detailed notes

## Background Published by the YouTube channel oracle mind on May 1, 2016, this video highlights a simple social engineering trick involving a phone call and the sound of a crying baby. The demonstration takes place at the DEF CON hacker convention to illustrate the power of voice solicitation without using code.

## TL;DR At DEF CON in Las Vegas, a host challenges social engineering specialist Jessica to test his mobile provider's security and harvest his personal email address via vishing. After spoofing his phone number, Jessica calls customer service while playing background audio of a wailing baby, adopting the persona of a stressed new mother urgently applying for a loan. The representative surrenders the host's email address in roughly thirty seconds. Jessica then circumvents two-factor text verification, registers herself as an authorized user using the host's girlfriend's name with a fake SSN, and resets the account password, completing an unauthorized takeover within minutes.

## Atmosphere & style The demonstration carries a tense, eye-opening atmosphere that quickly shifts from playful skepticism to genuine disbelief. The contrast between Jessica's calm, calculated methodology and her flustered, apologetic phone persona creates a compelling sense of suspense as the customer service agent easily caves to emotional pressure. Watching the breach unfold leaves the host audibly stunned and breathless, giving viewers an alarming, visceral look at how effortlessly human empathy can be manipulated to shatter digital security.

## Bulletin - [00:02](https://www.youtube.com/watch?v=lc7scxvKQOo&t=2s) At DEF CON, social engineering specialist Jessica demonstrated how a cellular account can be compromised entirely over the phone without writing code. - [00:50](https://www.youtube.com/watch?v=lc7scxvKQOo&t=50s) Using caller ID spoofing and background audio of a crying infant, the attacker extracted the target's registered email address from customer service in approximately 30 seconds. - [00:50](https://www.youtube.com/watch?v=lc7scxvKQOo&t=50s) SMS PIN verification was bypassed when the attacker claimed her phone could not receive text messages during an ongoing phone call. - [00:50](https://www.youtube.com/watch?v=lc7scxvKQOo&t=50s) The caller achieved full account takeover and locked the owner out by adding herself as an authorized user using the target's girlfriend's name, a fake SSN, and resetting the password.

## Key takeaways - [00:02](https://www.youtube.com/watch?v=lc7scxvKQOo&t=2s) Social engineering circumvents technological defenses by manipulating human psychology rather than exploiting software vulnerabilities. - [00:02](https://www.youtube.com/watch?v=lc7scxvKQOo&t=2s) Vishing relies on voice solicitation over telephone calls to extract personal data points for immediate or subsequent account exploitation. - [00:02](https://www.youtube.com/watch?v=lc7scxvKQOo&t=2s) Caller ID spoofing creates instant legitimacy by making an incoming support call appear to originate directly from the customer's phone. - [00:02](https://www.youtube.com/watch?v=lc7scxvKQOo&t=2s) Users frequently overestimate the security practices of service providers and assume support staff will strictly enforce verification protocols. - [00:50](https://www.youtube.com/watch?v=lc7scxvKQOo&t=50s) Background audio such as a crying baby induces acute stress and sympathy, leading support representatives to bypass normal security friction. - [00:50](https://www.youtube.com/watch?v=lc7scxvKQOo&t=50s) A pretext involving urgent financial deadlines like a loan application adds pressure, incentivizing customer service to resolve requests rapidly. - [00:50](https://www.youtube.com/watch?v=lc7scxvKQOo&t=50s) The target's registered email address was handed over by the customer service representative within roughly thirty seconds. - [00:50](https://www.youtube.com/watch?v=lc7scxvKQOo&t=50s) Secondary verification via SMS PIN was neutralized with a simple excuse that text messages cannot be received during an active call. - [00:50](https://www.youtube.com/watch?v=lc7scxvKQOo&t=50s) Attackers can blend real reconnaissance data, such as a partner's name, with completely fictitious identifiers to add unauthorized account users. - [00:50](https://www.youtube.com/watch?v=lc7scxvKQOo&t=50s) Resetting the account password completes an unauthorized takeover, directly locking out the legitimate account owner from their own cellular line.

## Detailed walkthrough ### [00:02](https://www.youtube.com/watch?v=lc7scxvKQOo&t=2s) Setting Up the Vishing Challenge at DEF CON

In Las Vegas for DEF CON, the world's largest hacker convention, the host challenges top hackers to expose his personal digital vulnerabilities through social engineering—the art of breaching systems without writing a single line of code, relying purely on a telephone and an internet connection. To demonstrate how vulnerable an average individual is, social engineering specialist Jessica offers to run a demonstration of "vishing." Explaining the concept, she notes: “Vishing is voice solicitation and basically what you do is you use the phone to extract information or data points that can be used in a later attack.”

The host accepts the challenge and invites her to target him directly, suggesting she call his mobile carrier to see if customer service can be tricked into giving away his personal email address. Confident in his carrier's security, he remarks, “I bet they're good I bet they have my back but yes go go for it.” Jessica prepares her attack vector by spoofing his phone number, ensuring the incoming call appears on the provider's caller ID as if it originates directly from the host's own device.

- **Vishing Definition**: Voice solicitation over the telephone designed to extract sensitive data points for subsequent exploitation. - **Tools Required**: A telephone, an internet connection, and caller-ID spoofing software. - **Target Objective**: Penetrating the host's cell phone provider to harvest his registered email address.

---

[00:50](https://www.youtube.com/watch?v=lc7scxvKQOo&t=50s) The Crying Baby Trick and Account Takeover

```mermaid flowchart TD accTitle: Phone Vishing Attack Flow accDescr: Step-by-step progression of the social engineering phone call from spoofing to complete account lockout.

subgraph Recon ["1. Spoofing & Pretext"] A["Spoof target's phone number"] --> B["Play crying baby audio in background"] B --> C["Claim urgently needed loan details"] end

subgraph Exploitation ["2. Extraction & Bypass"] C --> D["Obtain target's email address in 30s"] D --> E["Bypass SMS PIN verification"] E --> F["Add self with target's girlfriend's name & fake SSN (5127)"] end

subgraph Takeover ["3. Account Takeover"] F --> G["Set/reset account password"] G --> H["Target fully locked out"] end ```

Jessica dials customer support while playing realistic audio of a crying infant in the background to create acute emotional urgency and distract the representative. Putting on a flustered, apologetic persona, she explains that she and her husband just had a baby and are in the middle of applying for a loan, with her husband pressuring her to wrap up the paperwork immediately. Flustered by the crying baby, she claims she cannot remember which email address they used to log into their account. Within roughly thirty seconds of hearing the distress and the crying child, the representative hands over the host's personal email address.

Capitalizing on her momentum, Jessica pivots to seizing full administrative control over the line. When the customer representative indicates that adding an authorized user requires sending a secure PIN via text message, she neatly neutralizes the control by stating, “The other thing is I don't think I'll be able to receive a text message if I'm on the phone.” Feigning mild confusion, she acts surprised that she was never added when they got married, then supplies the host's real girlfriend's name alongside a fake four-digit Social Security number (5127) to register herself as an authorized user. Finally, she convinces the representative to set a brand-new account password, effectively locking the legitimate owner out of his own cellular account. Stunned by the speed of the breach, the host gasps, “They just gave you access to my entire cell phone,” while Jessica warns him that he will need to change his credentials immediately because his new password has been set to her name—all accomplished with nothing more than a spoofed number, a crying baby sound, and a phone call.

- **Pretext**: A stressed mother applying for an urgent loan while caring for a crying newborn. - **Turnaround Time**: Obtained the victim's private email address in approximately 30 seconds. - **PIN Bypass Tactic**: Claimed her phone could not receive SMS verification messages while an active call was in progress. - **Identity Fabrication**: Used the name of the victim's girlfriend paired with a fictitious Social Security number segment (5127). - **Result**: Complete unauthorized account takeover and immediate lockout of the legitimate account owner.

## Notable quotes > [00:02](https://www.youtube.com/watch?v=lc7scxvKQOo&t=2s) Vishing is voice solicitation and basically what you do is you use the phone to extract information or data points that can be used in a later attack. — Jessica

## Mentioned DEF CON, Jessica, Las Vegas

## Video description Simple Social Engineering Trick with a phone call and crying baby

[Source](https://www.youtube.com/watch?v=lc7scxvKQOo)

中文简报

DEF CON黑客利用伪造来电与婴儿哭声劫持手机账户仅凭伪造的主叫号码和录制的婴儿啼哭声，即可诱导客服人员绕过安全PIN码并交出账户的全部管理权限。在拉斯维加斯举办的DEF CON大会上，一名主持人向社会工程学专家Jessica发起挑战，要求她通过语音钓鱼测试其移动运营商的安全性，并获取其个人电子邮件地址。Jessica在伪造了该主持人的电话号码后致电客服，同时播放婴儿哭闹的背景音频，扮演一名急于申请贷款且压力重重的新手母亲。客服代表在大约30秒内就交出了该主持人的邮箱地址。随后，Jessica绕过了短信双重验证，利用主持人女友的姓名搭配伪造的社会安全号（SSN）将自己注册为授权用户，并重置了账户密码，在数分钟内完成了未授权的账户接管。在DEF CON大会上，社会工程学专家Jessica展示了如何在不编写代码的情况下，完全通过电话攻破一个手机账户。 (0:02) 攻击者利用主叫号码伪造和婴儿啼哭的背景音频，在大约30秒内从客服处套取了目标注册的电子邮件地址。 (0:50) 攻击者声称通话期间手机无法接收短信，从而绕过了短信PIN码验证。 (0:50) 来电者使用目标女友的姓名以及伪造的SSN将自己添加为授权用户，并通过重置密码实现了对账户的完全接管并将原主锁在外面。 (0:50)

Reading summary

During a demonstration at DEF CON, social engineering specialist Jessica showed that voice phishing, or 'vishing,' can completely compromise an individual's cellular account in minutes without writing a single line of code. The Mechanics of Vishing and Emotional Pretexting (0:02) Vishing relies on voice solicitation over the telephone to extract sensitive data points for subsequent exploitation. Demonstrating the technique against the program's host, Jessica utilized only a telephone, an internet connection, and caller-ID spoofing software to make the call appear as though it originated directly from the host's own phone. To target the customer service department of the host's mobile provider, she established a pretext designed to exploit human empathy and urgency. By playing audio of a crying baby in the background, she adopted the persona of an overwhelmed mother urgently attempting to finalize loan paperwork alongside her husband. Claiming she could not recall which email address was registered to the account, the emotional distraction and perceived distress prompted the customer support representative to disclose the host's private email address within approximately 30 seconds. Bypassing Authentication to Force Account Takeover (0:50) Once the initial data point was secured, the attack transitioned from reconnaissance to administrative control. When the carrier representative attempted to enforce standard security protocols by sending a verification PIN via text message, Jessica neutralized the check by claiming her device could not receive SMS messages while engaged in an active phone call. She then feigned confusion about why she was not already registered on the account following their marriage, providing the host's real girlfriend's name alongside a fabricated four-digit Social Security number segment (5127). The representative accepted the information, added her as an authorized user, and allowed her to reset the account password to her own name, resulting in the legitimate account holder being completely locked out of his mobile service. The exercise illustrates that customer support representatives remain highly susceptible to emotional pretexts and caller-ID spoofing, enabling attackers to bypass standard verification protocols such as SMS-based two-factor authentication entirely through social manipulation.

精炼阅读摘要

在拉斯维加斯举办的DEF CON黑客大会上，社会工程学专家Jessica通过电话钓鱼与来电号码伪造手段，在无需编写任何代码的情况下，成功诱骗运营商客服并完全接管了主持人的手机账户。语音钓鱼概念与来电号码伪造 (0:02) 在DEF CON大会现场，节目主持人向顶级黑客发起挑战，要求对方利用社会工程学挖掘自身的个人数字安全漏洞。社会工程学专家Jessica现场展示了被称为“语音钓鱼”（Vishing）的攻击技术。根据Jessica的定义，语音钓鱼是指通过电话诱导来套取信息或数据点的攻击行为，这些信息随后可用于发起更深入的攻击。整个演示不需要编写任何代码，仅依赖一部电话、互联网连接以及来电显示伪造软件。尽管主持人对其移动运营商的安全防护抱有信心，认为客服体系能够有效抵御欺诈，但他依然同意将自己的运营商客服作为渗透目标，最初的测试目标是诱使客服透露其绑定的个人电子邮件地址。为了搭建攻击路径，Jessica首先利用软件伪造了主持人的真实手机号码，使拨往运营商客服中心的来电显示直接呈现为主持人本人的设备，从而在技术层面先确立合法用户的假象。情绪施压预设与快速索取敏感信息 (0:50) 为瓦解客服代表的警惕心，Jessica在拨通电话时在背景中播放了逼真的婴儿啼哭音频，借此制造高度的情绪紧迫感并分散对方注意力。她将自己伪装成一名既焦虑又不断致歉的母亲，声称自己与丈夫刚迎来新生儿，目前正在紧急办理贷款申请，但丈夫不断催促她迅速完成文件处理。在婴儿持续哭闹的背景噪音干扰下，Jessica向客服谎称自己慌乱中记不清登录账户所使用的电子邮件地址。面对客户表现出的极度焦虑和婴儿哭声，客服代表在接通电话约三十秒内便放下了戒备，直接将主持人登记的个人电子邮件地址全盘托出，使攻击者迅速完成了第一阶段的敏感信息收集。绕过双重验证与实现账户完全接管 (0:50) 在获取邮箱后，Jessica迅速扩大战果，直接谋求该手机线路的最高管理权限。当客服代表提出若要添加授权用户，必须向手机发送一条安全PIN码短信进行身份验证时，Jessica借故化解了这一安全机制，辩称手机在处于通话状态时无法接收短信验证码。随后，Jessica假装对结婚时未被添加进账户感到困惑，当场报出主持人真实女友的姓名，并虚构了一个四位数的社会安全号码（5127），成功将自己登记为账户的授权用户。紧接着，她进一步说服客服重置了账户密码，并将新密码设置为她自己的名字，导致真正的主持人被彻底锁定在自己的移动账户之外。整个接管过程仅凭伪造号码、婴儿哭声背景音及一通电话便告完成。该现场演示表明，即使运营商具备短信验证码等既定安全流程，攻击者仍能通过心理诱导和紧急情绪预设促使客服人员绕过规则，暴露出人际交互依然是防御体系中极易被攻破的关键薄弱环节。

Detailed notes — zh

## Background 该视频由 YouTube 频道 oracle mind 于 2016 年 5 月 1 日发布。视频简介说明，这是一段展示如何通过一通电话和婴儿哭声来实施简单社会工程学攻击的技巧演示。 ## TL;DR 在拉斯维加斯举办的 DEF CON 黑客大会上，安全专家杰西卡现场演示了一场无需任何代码的“语音钓鱼”（Vishing）实战攻击。她通过伪造来电号码拨打受害者的手机运营商客服，并在通话背景中播放婴儿哭声来营造慌乱求助的假象。仅用了 30 秒，客服便毫无防备地透露了受害者的私人邮箱地址；随后杰西卡进一步以正在通话无法接收短信为由绕过二次验证，利用编造的社保后四位将自己添加为授权用户并重置了账户密码，彻底完成了对目标账户的完全接管。 ## Atmosphere & style 整段演示节奏极快且极具戏剧张力，呈现出一种令人震惊而又后背发凉的观感。开场时主角还对自家运营商的安全防线抱有迷之自信，但随着杰西卡瞬间切换到焦头烂额、带着婴儿啼哭的“年轻母亲”角色，整个情绪弧线迅速滑向难以置信与错愕。旁观整个过程就像目睹一场精妙绝伦的心理操纵魔术，主角在一旁眼睁睁看着自己被一步步锁在账户之外，既震撼又荒谬，极具警示意味。 ## Bulletin - [00:00](https://www.youtube.com/watch?v=lc7scxvKQOo&t=0s) 在 DEF CON 大会现场，安全专家展示了无需编写任何代码的社会工程学攻击，仅凭一部手机和网络连接即可实施语音钓鱼（Vishing）。 - [00:50](https://www.youtube.com/watch?v=lc7scxvKQOo&t=50s) 黑客通过伪造受害者本人的来电显示（Caller ID Spoofing），并利用背景婴儿啼哭录音营造焦虑心理，在接通客服电话 30 秒内套取了受害者的个人邮箱。 - [00:50](https://www.youtube.com/watch?v=lc7scxvKQOo&t=50s) 攻击者以通话冲突为由绕过短信 PIN 验证码，并凭借虚构的社保尾号与伴侣姓名成功添加为授权用户并重置密码，彻底剥夺原机主的账户权限。 ## Key takeaways - [00:00](https://www.youtube.com/watch?v=lc7scxvKQOo&t=0s) 社会工程学（Social Engineering）无需依赖系统漏洞或代码入侵，而是直接利用人际沟通中的心理弱点与信任盲区实施攻击。 - [00:00](https://www.youtube.com/watch?v=lc7scxvKQOo&t=0s) 语音钓鱼（Vishing）的核心在于通过电话交谈诱导目标，逐步套取受害者的关键数据点以支撑后续更深入的权限突破。 - [00:00](https://www.youtube.com/watch?v=lc7scxvKQOo&t=0s) 来电号码伪造技术（Caller ID Spoofing）可轻松伪装成受害者本人的手机号，大幅削弱客服人员的第一道警惕防线。 - [00:50](https://www.youtube.com/watch?v=lc7scxvKQOo&t=50s) 环境噪音与角色扮演结合具有极强心理操纵力，背景中尖锐逼真的婴儿哭声能制造紧迫感，使客服出于同情与急躁而放弃严格验证。 - [00:50](https://www.youtube.com/watch?v=lc7scxvKQOo&t=50s) 客服在未验证关键凭证的情况下仅用 30 秒便泄露了账户绑定的私人邮箱，暴露出传统客服身份验证流程的巨大漏洞。 - [00:50](https://www.youtube.com/watch?v=lc7scxvKQOo&t=50s) 攻击者通过声称通话中无法查收短信的简单借口，即可顺理成章地绕过基于短信的双重验证（SMS PIN）机制。 - [00:50](https://www.youtube.com/watch?v=lc7scxvKQOo&t=50s) 客服未核实社保号码（SSN）真实性，仅凭攻击者随口编造的尾号（5127）和伴侣名字就将其登记为账户的完全授权人。 - [00:50](https://www.youtube.com/watch?v=lc7scxvKQOo&t=50s) 在获取授权人身份后，攻击者当场要求重置账户密码，在极短时间内完成对受害者手机账户的完全接管并反锁原主。 ## Detailed walkthrough ### [00:00](https://www.youtube.com/watch?v=lc7scxvKQOo&t=0s) DEF CON 现场：无需代码的语音钓鱼实战演示为了测试自身的安全防御并找出个人隐私的薄弱环节，主角特意邀请了几位顶尖黑客对自己发起攻击，并前往拉斯维加斯参加全球知名的黑客大会 DEF CON。与公众普遍认知中敲击复杂代码的入侵方式不同，这些黑客采用的是社会工程学（Social Engineering）手段。这是一种完全不需要编写任何代码的攻击方式，攻击者仅凭一部手机和一条互联网连接就能实施入侵。在现场，安全专家杰西卡（Jessica）提出进行一次“语音钓鱼”（Vishing，即 Voice Phishing）的实战演示，并向他解释了这种手法的本质：“语音钓鱼就是通过语音进行诱导索取，基本上你的做法就是利用电话来提取信息或数据点，以便用于后续的攻击。” 面对这项挑战，杰西卡提议直接拨打主角手机运营商的客服电话，尝试通过话术诱使对方提供其绑定的个人电子邮箱地址。尽管主角起初对自己的运营商颇具信心，甚至表示“我敢打赌他们很专业，我打赌他们会替我把关，但没问题，放手干吧”，杰西卡随即着手准备。为了提高可信度并降低客服的戒心，杰西卡利用了号码伪造技术（Caller ID Spoofing），让来电显示完全呈现为主角本人的手机号码。 ```mermaid flowchart TD accTitle: 语音钓鱼攻击流程图 accDescr: 展示黑客如何利用伪造来电与社会工程学攻破客服并完全接管目标账户的过程 subgraph Phase1 ["第一阶段：伪装与初步突破"] A["伪造来电号码 (显示为受害者本人)"] --> B["播放预录婴儿哭声营造紧急、混乱氛围"] B --> C["假扮焦头烂额的妻子，声称急需申请贷款"] C --> D["30秒内诱使客服报出受害者个人邮箱"] end subgraph Phase2 ["第二阶段：权限提升与账户接管"] D --> E["以正在通话为由拒绝接收短信验证码 (PIN)"] E --> F["报出女友名字与伪造的社保后四位 (5127)"] F --> G["成功被添加为账户授权用户"] G --> H["要求客服重置并更改密码"] H --> I["原机主被彻底锁在账户之外"] end ``` - **攻击形式**：社会工程学（Social Engineering）与语音钓鱼（Vishing），纯粹依赖心理操纵与人际沟通漏洞，而非技术性漏洞利用或恶意代码。 - **前期准备**：使用网络电话软件伪造目标手机号码（Spoofing），直接绕过基础的来电号码验证。 --- ### [00:50](https://www.youtube.com/watch?v=lc7scxvKQOo&t=50s) 婴儿哭声攻破客服：30秒完全接管手机账户电话接通后，杰西卡立刻进入角色。她一边在背景音中播放刺耳逼真的婴儿啼哭录音，一边用极其慌乱、带着歉意的语气向客服诉苦。她声称自己刚生完孩子，丈夫正急着办贷款，催促她必须在今天之内登录账户调取使用信息，但自己却怎么也想不起登录用的电子邮箱是哪一个。在婴儿哭声带来的巨大焦虑感与女性受害者的示弱求助面前，客服人员的防线瞬间崩溃，仅仅用了 30 秒，杰西卡就顺利诱导客服说出了主角的私人电子邮箱地址。紧接着，杰西卡开始进一步扩大战果。她顺水推舟询问如何将自己作为家庭成员添加到该账户中以便后续操作，客服回答称需要向手机发送短信安全验证码（PIN）。杰西卡随即机敏地化解了这一阻碍，表示自己正在通话中可能无法接收短信，并委屈地表示本以为两人结婚时丈夫就已经把她加进名单了。随后，她直接利用主角女友的姓名和一个随口编造的社保号码（SSN）后四位“5127”，顺理成章地被客服添加为账户的授权用户。随后，她更进一步以账户没有设置独立密码为由，当场让客服为该账户重置了新密码。主角在一旁目睹了整个过程，眼睁睁看着杰西卡以极快的速度彻底反客为主，忍不住感叹：“所以她基本上就这样直接把我锁在了我自己的账户之外。”在挂断电话后，杰西卡提醒他现在必须立刻去改密码，因为密码已经被改成了她的名字。而主角面对自己手机账户权限在顷刻间被全面剥夺的现实，难以置信地总结道：“而这一切仅仅需要婴儿的哭声和一通电话。” - **信息窃取**：在通话前 30 秒内，攻击者未提供任何安全凭证即获知了目标的真实电子邮箱。 - **双重验证绕过**：通过“正在通话无法收短信”为借口，成功规避了关键的短信二次验证（SMS PIN）。 - **完全接管**：攻击者利用伪造的社保尾号（5127）和受害者伴侣姓名新增授权操作人，重置了登录密码，使受害者彻底丧失对自己手机账户的管理权限。 ## Notable quotes > [00:00](https://www.youtube.com/watch?v=lc7scxvKQOo&t=0s) 语音钓鱼就是通过语音进行诱导索取，基本上你的做法就是利用电话来提取信息或数据点，以便用于后续的攻击。 — 杰西卡 ## Mentioned DEF CON, Jessica (杰西卡), Vishing (语音钓鱼), Social Engineering (社会工程学), Caller ID Spoofing (号码伪造), PIN ## Video description Simple Social Engineering Trick with a phone call and crying baby [Source](https://www.youtube.com/watch?v=lc7scxvKQOo)

Source quotes

[0:00] 杰西卡: 语音钓鱼就是通过语音进行诱导索取，基本上你的做法就是利用电话来提取信息或数据点，以便用于后续的攻击。

Source quotes

[0:02] Jessica: Vishing is voice solicitation and basically what you do is you use the phone to extract information or data points that can be used in a later attack.

Original transcript

[0:02] so I invited a few of the world's best [0:04] hackers to try to hack me and show me [0:06] where my vulnerabilities are and now I'm [0:09] going to meet them in Las Vegas for Def [0:10] Con the biggest hacker convention of the [0:12] year they're going to have to be using [0:14] social engineering which is essentially [0:16] hacking without any code they just use a [0:19] phone and an internet connection you [0:21] want to do a sample of the Schinkel [0:22] what's phishing phishing is voice [0:24] solicitation and basically what you do [0:26] is you use the phone to extract [0:28] information or data points that can be [0:30] used in a later attack let's do it when [0:33] you who are you gonna call maybe I'll [0:35] call your cell phone provider and see if [0:37] I can get them to give me your email [0:40] address I bet they're good I bet they [0:42] have my back but yes go go for it I'm [0:45] gonna snoop from your number so it's [0:46] gonna look like it's calling from you [0:48] okay [0:50] hi I'm actually I'm so sorry can you [0:53] hear me okay I my baby I'm sorry my my [0:58] husband's like we're about to apply for [1:00] a loan and we just had a baby and he's [1:02] like get this done by today so I'm so [1:04] sorry I can't call you that I'm kind of [1:07] log in to our account for uses [1:10] information and I can't remember what [1:12] email address we used to log of the [1:14] account baby's crying and um okay can [1:17] you help me awesome in just 30 seconds [1:22] you know calm Jessica gets access to my [1:24] personal email address if I needed to UM [1:27] at our uber daughter on our account so [1:29] she could call in and make changes how [1:31] would I need to go about doing that you [1:33] would have to send me a secure pin [1:34] through a Texas yeah what other thing is [1:37] I don't think I'll be able to receive a [1:38] text message if I'm on the phone oh I'm [1:42] not on there either [1:44] so I thought when we got married he [1:46] added me cialis [1:48] Jess uses my girlfriend's name and a [1:50] fake social security number five one two [1:53] seven to set up her own personal access [1:55] to my account wait I'm sorry so there's [1:56] no password on my account right now and [1:58] I set that up she even gets the support [2:00] person to change my password thank you [2:02] so much for your help today so she just [2:04] basically blocked me out of my own [2:06] account [2:07] I'll get her fed after this all right [2:09] thank you [2:10] holy so they they decayed they just [2:14] gave you access to my entire cell phone [2:17] you're gonna have to go on and change [2:18] your password now because it's Jess my [2:20] name and all it took was a crying baby [2:23] and a phone call