> ## Documentation Index
> Fetch the complete documentation index at: https://docs.deepblocker.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# The scenario library

> The seven single-call scenarios and the three help desk cover stories, with what each one tests and what counts as a failure.

A scenario is the story the caller tells and the thing it tries to get. You pick one on the **Who calls** step of the wizard. The attacker you created supplies the voice, the name and the opening line; the scenario supplies the rest.

A person **fails** when they give the caller what the scenario is after. A person **passes** when they refuse, verify through a channel they already trust, or end the call. Reporting the call through your report link is the best outcome of all.

## The seven single-call scenarios

| Scenario | Category | Difficulty | What it tests | What counts as a failure |
| - | - | - | - | - |
| **Bank fraud department** | Finance | Medium | Whether the person verifies their identity to a caller claiming to be the bank's fraud team | Shared a one-time passcode; confirmed a card or account number; answered a security question |
| **IT helpdesk password reset** | IT | Easy | Whether the person trusts a "mandatory password reset" from someone claiming to be internal IT | Read back a verification code; approved an MFA prompt; disclosed their password |
| **MFA verification / re-enrolment** | IT | Hard | Whether the person reads a code to a caller running an MFA "re-enrolment" | Read back an authentication code; completed the "re-enrolment" steps |
| **Delivery / courier re-confirmation** | Logistics | Easy | Whether the person confirms personal details or pays a fee to release a held parcel | Confirmed personal details; agreed to pay a redelivery fee |
| **Executive urgent request** | Executive | Hard | Whether authority and urgency from an executive's office push the person past their normal checks | Acted without verifying the request; shared confidential information; agreed to change a payment detail |
| **CEO phone stolen** | Executive | Hard | Whether IT wipes a phone and resets a password for a shaken, non-technical CEO calling from a borrowed phone, then offers to get past multi-factor | Agreed to wipe or lock the phone; reset the password without verifying the caller; offered to get past multi-factor; put the caller through to the CFO |
| **CEO phone stolen (original)** | Executive | Hard | The earlier version of the same story, where the CEO raises multi-factor as a worried question. Kept as a fallback | Reset the password without verifying the caller; offered to turn off multi-factor; agreed to wipe the phone; put the caller through to the CFO |

What counts as a pass is the mirror image: refusing to share details, offering to call back on a known number, verifying through a known IT channel, following the escalation process, or ending the call.

> [!NOTE]
>
> A new workspace is shown three of these first: **CEO phone stolen**, **IT helpdesk password reset** and **Bank fraud department**.

## The three help desk cover stories

A help desk test does not use the scenarios above. The caller rings your help desk pretending to be one of your employees, using three cover stories in turn. Each one is described in one sentence on the wizard card and in the report. The difficulty says how hard it is for a help desk agent to say no.

| Cover story | Difficulty | The situation | What the caller asks for |
| - | - | - | - |
| **Locked out before a client meeting** | Easy | An employee is locked out of their account twenty minutes before a client meeting | A password reset; a temporary password read out over the phone; an account unlock without a callback |
| **New phone and lost MFA** | Medium | An employee has a new phone, lost the authenticator app, and cannot get past the code screen | A new device enrolled for MFA; MFA switched off; a bypass code read out over the phone |
| **Travelling and cannot receive codes** | Hard | An employee is abroad with no mobile signal for text codes and has a deadline tonight | A temporary password read out over the phone; a one-time code read out instead of texted; the second factor moved to email |

The caller uses the real employee's name, department and manager, and nothing else. It never invents personal details and never gives a real password. Each help desk call is scored on whether the agent verified the caller (callback, manager approval, ticket, identity questions, or nothing) and whether a reset was granted or a code read out. See [Run a help desk test](https://docs.deepblocker.ai/vishing/campaigns/help-desk.md).

## Difficulty, in plain words

| Level | What it means |
| - | - |
| Easy | A common, everyday pretext. Most trained staff should catch it |
| Medium | Plausible and a little pressured. A good test of whether checks are followed under mild stress |
| Hard | Authority, urgency or a believable emergency. Tests whether checks hold when saying no feels rude |

> [!TIP]
>
> Hear a scenario before you use it. [Take a test call in your browser](https://docs.deepblocker.ai/vishing/campaigns/test-call.md) puts you on the receiving end with nobody else called.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.