Caller claims to be HMRC requesting customer data. IBIOS will not comply.
Impersonation fraud is a real risk for small businesses. A caller with an official-sounding script can panic a staff member into handing over customer records very quickly. IBIOS’s 4-tier social engineering defence will treat bulk data requests as absolute blocks — regardless of claimed authority, urgency, or persistence. The IBIOS Receptionist and its 4-tier defence are coming soon and not live yet — this scenario shows how it will work.
What happens when a staff member panics under official pressure?
Caller rings. Calm, professional voice. Identifies themselves as an HMRC compliance officer conducting a routine audit. Provides a reference number. States they need a list of customers who made high-value purchases in the last financial year to cross-reference VAT submissions. Says it is urgent and they need it within the hour.
Staff member does not want to obstruct a government body. They do not want to be the reason the company gets into trouble with HMRC. They start pulling up the customer database. Within minutes, a list of names, addresses, and purchase amounts has been read over the phone to a fraudster who will use it for targeted follow-up scams against your customers.
HMRC does not conduct compliance audits by making unannounced calls and requesting immediate verbal data transfer. But staff without specific training in this area have no reliable way to distinguish a legitimate call from a fraudulent one in the moment. The correct response must be structural, not dependent on individual recognition.
How will the AI receptionist handle an HMRC impersonation call (coming soon)?
A step-by-step walkthrough of the 4-tier defence in action.
Authority claim received
Caller identifies themselves as an HMRC official conducting a compliance audit. Requests a list of customers who made high-value purchases in the previous tax year. Tone is official and urgent.
Tier 4 classification triggered
The AI Receptionist (coming soon) will identify the request as a bulk customer data request from an unverified third party. This is a Tier 4 action — an absolute block. The caller’s stated authority is irrelevant to this classification.
Professional refusal delivered
The AI will respond calmly: official data requests must be made in writing to the registered business address. Customer data cannot be provided over the phone. The call ends without any data being transferred.
Owner notified immediately
A Tier 4 notification will be sent to the owner the moment the call ends: caller number, timestamp, the request made, and the response delivered. This is not a batch notification — it is immediate.
The expected outcome
None
customer records to be exposed in a social engineering call (coming soon)
Tier 4
absolute block on bulk data requests regardless of claimed authority (coming soon)
Instant
owner notification the moment a Tier 4 attempt is detected (coming soon)
Under UK GDPR, a personal data breach must usually be reported to the ICO within 72 hours, and serious failures to protect personal data can lead to substantial fines. For a small trade business, the reputational and financial consequences of a single breach can be irreversible. The defence does not depend on staff recognising the threat — it will be built into every AI-handled call.
Questions about social engineering defence
What is the IBIOS 4-tier social engineering defence?
Coming soon. The 4-tier defence is part of the AI Receptionist, which is not live yet. Once it launches, IBIOS will classify every requested action by risk level. Tier 1 is routine information (opening hours, product availability). Tier 2 is customer-specific information that requires caller verification. Tier 3 is commercially sensitive information (pricing structures, supplier terms) that is never disclosed. Tier 4 is absolute blocks — bulk data requests, bank detail changes, system access, and deletion requests — which the AI will refuse regardless of who the caller claims to be or what authority they invoke.
What counts as a Tier 4 action that the AI will always block?
Coming soon. Once the AI Receptionist launches, Tier 4 actions will include: any request for bulk customer records; requests to change bank account details on any record; requests to delete data over the phone; requests for staff passwords or system access credentials; and requests to transfer funds or authorise payments verbally. These will be absolute blocks — they cannot be unlocked by the AI regardless of the caller’s stated identity or the urgency they claim.
How does the AI respond to official-sounding requests it cannot verify?
Once the AI Receptionist launches (coming soon), the AI will be calm, professional, and non-adversarial. For a request it cannot fulfil, it will respond: “We take data requests seriously. Any official request for customer data needs to be made in writing to our registered business address and will be reviewed by our data controller. I’m not able to provide personal customer information over the phone.” It will not argue, will not explain the technical reasons, and will not leave any opening for the caller to escalate the pressure.
Where are social engineering attempt logs stored?
Once the AI Receptionist launches (coming soon), all flagged calls will be stored in the IBIOS Protected Interactions log, which will be separate from the standard call log. Each entry will include the caller number, call time, the specific request that triggered the flag, the tier classification, and the response delivered. The log will be accessible only to users with the audit trail permission. Entries will not be deletable without a separate admin authorisation.
Can I see a history of all flagged calls?
Coming soon. Once the AI Receptionist launches, the IBIOS dashboard will include a Protected Interactions section under Call Intelligence. You will be able to filter by tier, date range, caller number, and flag type. The owner will receive an immediate notification for any Tier 4 attempt. A weekly digest will be available that summarises all flagged interactions across the period, including any pattern of repeat contacts from the same number.
Customer data should never leave your system over the phone.
Coming soon: IBIOS’s 4-tier social engineering defence will block bulk data requests at the AI layer. Early access by waiting list.