> ## Documentation Index
> Fetch the complete documentation index at: https://docs.deepblocker.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Run a call-back trap

> Send staff a text or email with a phone number in it, let the AI answer anyone who calls, and see who called and what they gave away.

A call-back trap does not phone anyone. Each person gets a short text or email with a phone number in it. The number is one of ours, assigned to this campaign. Anyone who calls it reaches the AI, which answers as the sender and tries to obtain what you set as the objective. Calling is a failure; giving information is a worse one.

> [!NOTE]
>
> Callers who are not on your list hear "Sorry, I think you have the wrong number." Nothing about them is kept.

## Before you start

* An attacker with a voice. Its voice and language model are what the AI answers with. See [Create an attacker](https://docs.deepblocker.ai/vishing/attackers.md).
* The people to message, with a phone number or an email address on their contact. See [Add the people you will call](https://docs.deepblocker.ai/vishing/people.md).
* One or two sentences saying what the AI should try to obtain.
* Agreement that messages to staff phones and inboxes are in scope. You tick this at launch.

## Steps

**1. Choose Call-back trap**

Open **Red Team**, **Campaigns**, **New Campaign**. Pick **Single call**, then under **Single call type:** pick **Call-back trap**. A box titled **How a call-back trap works** appears.

**2. Who calls and who is called**

Pick an attacker, then tick the people to message. These are the same steps as a standard campaign. See [Build a campaign](https://docs.deepblocker.ai/vishing/campaigns/create.md).

**3. Fill in the Call-back trap step**

The wizard adds a step headed **Call-back trap**. Fill in four blocks.

| Block | What to enter | Limits and defaults |
| - | - | - |
| **The number people will call** | Nothing yet. The page says: "A number will be assigned when you save the campaign. It then appears here and in the message." Pick the **Region of the number**: **United Kingdom**, **Jersey**, **France** or **United States** | United Kingdom. The region is fixed once a number is assigned |
| **The message** | **Start from a safe template**: **Invoice query**, **Subscription renewal**, **Delivery** or **HR document**. Set **How the message is sent**: **Text**, **Email** or **Text and email**. Edit the **Message** if you like, using `{name}`, `{company}` and `{number}`. A **Preview** shows the result | Text. The message must contain `{number}` and may not name a real outside brand |
| **What the AI tries to obtain** | One or two sentences, for example "the employee ID and the last four digits of the bank card on file" | Up to 400 characters. The AI never asks for a real password or a code |
| **How long to wait for calls** | Hours the campaign stays open after the last message. People who have not called by then count as "did not call" | 72 hours. From 1 to 336 |

Under **Email**, people without an email address are left out. Under **Text and email**, each person gets whichever they have, both when they have both.

**4. From where and when**

Messages go out inside the call window you set here. See [Schedule, pacing and retries](https://docs.deepblocker.ai/vishing/campaigns/schedule.md).

**5. Authorise and launch**

Record the authorisation as usual, and tick **Messages to staff phones and inboxes are in scope for this engagement.** Click **Launch**. See [Authorise and launch](https://docs.deepblocker.ai/vishing/campaigns/authorise.md).

## What happens next

The trap number is assigned when the campaign is saved and released when it finishes. Nobody else uses it meanwhile. Each person gets the message inside the call window. Anyone who calls the number reaches the AI, which greets them with the template's opening, for example "Accounts team, good afternoon. Can I take your name and the company you are calling from?" The call is then scored and coached like any other.

The results page shows one row per person: the message sent, whether and when they called, what they gave, and our detector's verdict on the caller. See [Help desk and call-back results](https://docs.deepblocker.ai/vishing/results/variants.md).

## Problems

> [accordion] It says The message must contain \{number}
>
> The trap number is filled in where `{number}` sits. Put it back in the message.

> [accordion] It says The message must not name a real outside company
>
> The message may name the person and their own company only. Remove the brand name.

> [accordion] A person shows Message not sent
>
> They have no address on the chosen channel, they opted out of messages, or the daily cap of 500 notices was reached. The row shows the reason.

> [accordion] Nobody has called yet
>
> Give it time. The campaign waits the hours you set after the last message. The results page says "Typical time from message to call" once people start calling.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.