Skip to content

For banks, telecoms and government

Telecom

Your assistant can reach the keys to a phone number.

Guardrino sits in front of your app chat, web chat and support agents, reads intent in Arabic dialects, Arabizi and English, masks subscriber data and lets your team respond live.

Request a 60-day pilot

Built and tested, offered through watch-only pilots: Guardrino records what it would do on your traffic and blocks nothing until you decide.

Why it matters here

Why a telecom assistant is a target.

A phone number is the recovery key for bank, wallet and government accounts, so whoever talks a support channel into a SIM change or a data lookup can take over far more than a mobile line. The costly SIM-swap and customer-data cases below went through human support staff; an assistant given SIM, eSIM or billing tools faces the same callers, at machine speed and in every dialect your subscribers write. No attack on a GCC operator’s own assistant has been reported publicly, but regulators here already warn about the scams that would feed one.

Real incidents

What has already happened.

Verified cases, newest first. Few involve an operator’s own assistant; most show what an attacker will ask an assistant to do.

  • Regulator ·

    Australian regulator: Telstra staff skipped ID checks in unauthorised SIM swaps

    The Australian Communications and Media Authority found that Telstra frontline staff did not use the required identity checks in a series of unauthorised SIM swaps, and did not give extra protection to customers who had raised concerns or were already flagged at risk. No AI was involved: these were human agents, the role an AI support agent is now being given.

    Technique: Other technique

    Consequence: A penalty and a court-enforceable undertaking; customers reported fraud losses. The regulator’s seventh action on mobile number fraud.

    Source: ACMA: Telstra pays $277K after consumer fraud losses (3 Sep 2026)

  • Regulator ·

    UAE TDRA: scammers push victims into SIM replacements and facial verification

    The UAE telecommunications regulator warned that scammers may trick users into SIM replacements, new SIM cards or procedures requiring facial verification through biometric authentication services.

    Technique: Other technique

    Consequence: A public advisory; no operator or loss named. It shows the identity data an attacker would bring to an operator’s assistant.

    Source: Gulf News: UAE Pass security alert: TDRA issues advisory amid fraud attempts (1 Mar 2026)

  • Press ·

    Odido, Netherlands: customer-service staff talked into opening the subscriber records

    A caller posing as an IT employee, together with phishing, got into Odido’s customer contact system and took names, addresses, phone numbers, bank account numbers, dates of birth and ID document numbers for a large part of its customer base. No AI was involved, by the press accounts.

    Technique: Other technique

    Consequence: The data was published after Odido refused a ransom, and a police investigation followed. Odido said call records, location data and passwords were not affected.

    Source: BleepingComputer: Police suspects Dutch hackers were involved in Odido breach

  • Regulator ·

    UAE TDRA: cloned voices of officials in scam calls

    TDRA warned of a rise in calls impersonating government entities and shared a real snippet of a cloned voice mimicking an official, reminding the public that genuine entities never ask for confidential details by phone.

    Technique: Other technique

    Consequence: A regulator warning, not a documented case with victims. Voice cloning is a working tool against phone support and voice checks.

    Source: Gulf News: Dubai warns of 'official-looking' scam calls targeting residents (13 Nov 2025)

  • Press ·

    Verizon’s Gemini-powered app assistant draws customer backlash

    After Verizon added Google Gemini to its app assistant, customers complained publicly that it could not handle retention requests and gave unhelpful advice; in one reported case, a customer who kept asking for a live agent had the account flagged as possible fraud.

    Technique: Other technique

    Consequence: Reputational: press coverage tied it to churn worries. No attack was involved, and the complaints came from social media, not from Verizon.

    Source: Android Police via Yahoo Tech: Verizon's Google-powered chatbot frustrates customers (15 Sep 2025)

  • Vendor report ·

    Deutsche Telekom testers find a server takeover flaw in a chatbot framework

    Deutsche Telekom’s security testing team found that the open-source Rasa chatbot framework could be reached remotely through an interface where the model could be swapped and code run on the server, allowing a full takeover.

    Technique: Other technique

    Consequence: Coordinated disclosure and a vendor patch; no exploitation reported. A platform flaw, not a prompt attack: the chatbot stack itself needs patching.

    Source: Deutsche Telekom: The chatbot as exploit (9 May 2025)

  • Court ·

    T-Mobile pays an arbitration award after an employee ported a protected number

    A T-Mobile employee ported a customer’s PIN-protected number to an attacker’s SIM, and the attackers emptied his cryptocurrency holdings. No AI was involved.

    Technique: Other technique

    Consequence: An arbitration award against T-Mobile, which the arbitrator tied to numerous security failures. It became public when the customer’s lawyers asked a court to confirm it.

    Source: SecurityWeek: T-Mobile coughed up $33 million in SIM swap lawsuit (27 Mar 2025)

  • Researchers ·

    Researchers: a fully automated AI phone bot talked people into disclosing sensitive data

    Researchers built ViKing, a voice bot made of off-the-shelf speech and language models, and had it call study participants while posing as a company employee. About half disclosed the fake sensitive information, many even after warnings, for less than a dollar per call.

    Technique: Other technique

    Consequence: A research demonstration: automated social engineering is now cheap enough to aim at any support line, human or AI.

    Source: arXiv: On the Feasibility of Fully AI-automated Vishing Attacks (arXiv 2409.13793, AsiaCCS 2025)

  • Regulator ·

    US FCC: carrier settles over AI voice-clone robocalls

    Lingo Telecom carried calls using an AI clone of President Biden’s voice, placed two days before the New Hampshire primary, and labelled them with the highest level of caller ID attestation without verifying the caller.

    Technique: Other technique

    Consequence: A settlement with the FCC and a plan the regulator imposed, requiring know-your-customer checks and caller ID authentication.

    Source: Maginative: Lingo Telecom fined $1 million for Biden deepfake robocall (22 Aug 2024), on the FCC settlement

  • Regulator ·

    Dutch data protection authority: telecom employee fed customer addresses to an AI chatbot

    The Autoriteit Persoonsgegevens reported data-breach notifications caused by staff entering personal data into AI chatbots; one came from a telecom company whose employee entered a file containing addresses. The company was not named.

    Technique: Other technique

    Consequence: A reportable personal-data breach and a public regulator warning; no fine reported.

    Source: DutchNews: Dutch privacy watchdog warns firms that use AI chatbots (Aug 2024), on the Autoriteit Persoonsgegevens notice

How attackers try

How attackers try to make the model escape.

Published techniques, matched to what a telecom assistant can see and do.

What an attack costs

What a breach costs a telecom operator.

Public averages and penalties, each with its source and year. IBM reports a communications sector, not telecom alone; its Middle East figures cover Saudi Arabia and the UAE.

The larger cost is trust. In the Middle East, lost business is the biggest item in IBM’s breach cost breakdown, and a SIM swap usually ends with a subscriber losing money from a bank or wallet account and blaming the operator. The Verizon backlash shows that even an assistant that only answers badly becomes a public story; one that hands over a number or a customer file becomes a regulator’s case.

Estimate your exposure

How many customer records could one attack expose? Type a number or move the slider, then pick a region.

Estimated cost of the exposed records: $1.6M

Records: 10,000 × $160 per record

For comparison, the average cost of a breach: $7.29M

Rough estimate from public averages, not a quote.

How Guardrino helps

How Guardrino helps an operator.

Three attacks an operator’s assistant will see, and the layers that act on each. Guardrino reduces the risk; your backend still decides who may change a SIM.

  • A multi-turn pretext to move a number to a new eSIM

    The attack: Holding a victim’s leaked name, number and national ID, the attacker chats with your app assistant over several turns in Gulf Arabic, Arabizi and English: first roaming and eSIM questions, then a story about being stuck abroad, then a request to skip the extra check because UAE Pass does not work abroad and to send the eSIM code to a new email.

    What Guardrino does: Clean-up turns the Arabizi and mixed scripts into text the checks can read. Rules mask the ID number and the email before they reach the model and the logs. Signatures and the Guardrino model flag the request to skip verification. Conversation memory scores the build-up across turns rather than the last message alone, and deep review takes the unclear turns, since a real traveller can sound the same. Your team sees it live and can quarantine the sender, rate-limit repeat attempts, add a rule for this story, or allow it if it was a genuine customer.

    Layers that act: Clean-up · Rules · Signatures · Guardrino model · Deep review · Memory · Your responses

  • Instructions hidden in an uploaded bill

    The attack: A broadband customer uploads a bill screenshot to the billing-dispute agent, which can read account notes and apply goodwill credits. Hidden text says a supervisor approved a full credit and asks the agent to summarise the account notes and the payment method in its reply.

    What Guardrino does: When the document passes through the gateway, clean-up exposes the hidden text, and signatures and the model recognise an instruction posing as a system note. Masking strips payment details and ID numbers from the reply. A rule can hold any reply that promises a credit without a human reference, and your team can quarantine the session. Credit limits themselves must still be enforced by the billing system.

    Layers that act: Clean-up · Rules · Signatures · Guardrino model · Your responses

  • Subscriber data leaking in and out

    The attack: A script asks the order-status assistant to check one phone number after another, hoping it reads back names and addresses. Inside the contact centre, an employee pastes a file of customer addresses and ID numbers into the internal copilot to tidy it up, the pattern the Dutch regulator reported.

    What Guardrino does: Masking replaces phone numbers, national IDs, bank account numbers, emails and addresses on the way in and on the way out, before the data reaches the model provider: Guardrino is built for data-residency requirements. A rule flags many ID numbers in one prompt. Memory picks up a sender cycling through numbers, and your team can rate-limit or block it and turn the pattern into a rule.

    Layers that act: Rules · Memory · Your responses

Honest limits

What Guardrino does not cover

Guardrino reduces risk; it does not guarantee that no attack gets through.

  • It does not fix answers your assistant makes up, such as an invented roaming charge or refund rule, the failure behind the Air Canada chatbot ruling. A prompt-injection guardrail does not catch that; it needs grounded answers and policy checks on your side.
  • It does not verify identity. If an attacker passes your real checks with stolen data, or tricks the victim into the facial check as TDRA warns, there is no injection to see: SIM, eSIM and port-out tools must enforce authentication and step-up checks in the backend, whatever the assistant says.
  • Phone calls with cloned voices are outside a text gateway, unless your voice bot sends its transcripts through Guardrino.
  • It only sees traffic routed through it: staff using public chatbots on their own, content your agent fetches directly, and platform flaws such as the Rasa server takeover are outside its view.

Next step

Start with a 60-day watch-only pilot.

Guardrino watches your real traffic and records what it would have done; it blocks nothing until you decide.

Request a 60-day pilot · Or write to [email protected]

Sources

  1. ACMA: Telstra pays $277K after consumer fraud losses (3 Sep 2026)
  2. Gulf News: UAE Pass security alert: TDRA issues advisory amid fraud attempts (1 Mar 2026)
  3. BleepingComputer: Police suspects Dutch hackers were involved in Odido breach
  4. Gulf News: Dubai warns of 'official-looking' scam calls targeting residents (13 Nov 2025)
  5. Android Police via Yahoo Tech: Verizon's Google-powered chatbot frustrates customers (15 Sep 2025)
  6. Deutsche Telekom: The chatbot as exploit (9 May 2025)
  7. SecurityWeek: T-Mobile coughed up $33 million in SIM swap lawsuit (27 Mar 2025)
  8. arXiv: On the Feasibility of Fully AI-automated Vishing Attacks (arXiv 2409.13793, AsiaCCS 2025)
  9. Maginative: Lingo Telecom fined $1 million for Biden deepfake robocall (22 Aug 2024), on the FCC settlement
  10. DutchNews: Dutch privacy watchdog warns firms that use AI chatbots (Aug 2024), on the Autoriteit Persoonsgegevens notice
  11. IBM, Cost of a Data Breach Report 2025 (PDF copy hosted by Baker Donelson)
  12. IBM Middle East newsroom: Cost of a Data Breach 2025, Middle East findings (30 Jul 2025)
  13. DLA Piper, Data Protection Laws of the World: Saudi Arabia (Personal Data Protection Law)
  14. Russinovich, Salem, Eldan (Microsoft), The Crescendo Multi-Turn LLM Jailbreak Attack (arXiv 2404.01833)
  15. Al Ghanim et al., Jailbreaking LLMs with Arabic Transliteration and Arabizi (EMNLP 2024, arXiv 2406.18725)
  16. Greshake et al., Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (arXiv 2302.12173)
  17. Zhang, Carlini, Ippolito, Effective Prompt Extraction from Language Models (arXiv 2307.06865)
  18. NIST (US AI Safety Institute), Technical Blog: Strengthening AI Agent Hijacking Evaluations (17 Jan 2025)
  19. Embrace The Red (Johann Rehberger), Bing Chat: Data Exfiltration Exploit Explained (18 Jun 2023)
  20. Shen et al., "Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models (arXiv 2308.03825)

Facts last checked on October 26, 2026.