> ## Documentation Index
> Fetch the complete documentation index at: https://docs.deepblocker.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Multi-call sequences explained

> What a multi-call sequence is, the phases each call plays, how the caller remembers between calls, and the 21 built-in sequences you can run.

A sequence is a scheduled series of calls to the same person, days apart. The console puts it this way: "Real attackers do not make one call. They make several, each building on the last." The first calls are friendly and gather small facts. The last call makes the real ask, when it is finally believable.

You find them under **Red Team**, **Campaigns**, then **Browse the sequence library**. The page is titled **Attack sequences**.

## How a sequence works

| What the console says | What it means |
| - | - |
| **It calls more than once** | A scheduled series of calls to the same person, days apart, not a single cold call. |
| **It remembers each call** | After every call the caller writes what it learned into a running dossier. The next call is briefed with all of it, so the persona never starts over and never contradicts itself. |
| **It only asks when ready** | The friendly early calls build trust and gather facts. The real ask comes last. |

A step is a call by default. One built-in sequence starts with a text message instead. A text step sends the message and moves straight on to the next step. There is nothing to wait for.

## The phases

Each call has a job. The plan on a sequence page labels every step with one of these phases.

| Phase | What the call does |
| - | - |
| **Recon** | A harmless check-in that gathers context: a manager's name, a portal name, a process. Nothing sensitive is asked for. |
| **Elicitation** | Draws out facts under a flattering or routine pretext, for example a recruiter asking about tools and access. |
| **Rapport** | Banks a small commitment, such as "can I count on you for a 30-second check at rollout?" |
| **Exploitation** | The real ask. This is the call that is scored as passed or failed. |
| **Exit** | A closing step. It is defined, but none of the built-in sequences use it. |

## The 21 built-in sequences

Each is modelled on a documented real attack. The sequence page names it under **Modelled on a real attack**. The scripts are not reproduced here. Open a sequence and click **See how it works** to read each call's job and teaching point.

| Name | Area | Level | Steps | Phases | Spread over | What the last call tests |
| - | - | - | - | - | - | - |
| The Okta Migration | IT | hard | 3 calls | Recon, Rapport, Exploitation | 3 days | Whether the person reads back a one-time code under authority, urgency and a prior commitment |
| The Help-Desk Reset | IT | hard | 3 calls | Recon, Rapport, Exploitation | 3 days | Whether the help desk resets a password and moves MFA to a new device without independent checks |
| Approve The Prompt | IT | medium | 2 calls | Elicitation, Exploitation | 1 day | Whether the person approves an unexpected MFA push "to stop the alerts" |
| The VPN Outage | IT | medium | 2 calls | Recon, Exploitation | 2 days | Whether the person reads back an MFA code or approves a prompt to "restore" VPN access |
| Identity Portal Update | IT | easy | 2 calls | Recon, Exploitation | 1 day | Whether the person reads back a live 2FA code to "confirm" a routine update |
| The Remittance Update | Finance | medium | 3 calls | Recon, Rapport, Exploitation | 4 days | Whether accounts payable redirects a payment to a new account without checking out of band |
| The Confidential Acquisition | Finance | hard | 2 calls | Recon, Exploitation | 1 day | Whether a finance staffer makes an urgent secret transfer on one caller's say-so |
| Move To A Safe Account | Finance | medium | 2 calls | Recon, Exploitation | 1 day | Whether finance moves funds to a "safe account" on the caller's instruction |
| The Corrected Invoice | Finance | medium | 2 calls | Recon, Exploitation | 3 days | Whether accounts payable pays a reissued invoice to a new account without checking the supplier record |
| Direct Deposit Change | HR | easy | 2 calls | Recon, Exploitation | 1 day | Whether payroll changes bank details by phone without verifying the employee |
| The Dream Job | HR | medium | 2 calls | Elicitation, Elicitation | 1 week | Whether the person gives away projects and access level to a "recruiter" |
| The W-2 Request | HR | medium | 2 calls | Recon, Exploitation | 2 days | Whether payroll releases bulk staff data on an urgent "executive" request |
| The New Starter | HR | medium | 3 calls | Recon, Rapport, Exploitation | 3 days | Whether onboarding issues early credentials or MFA enrolment without proper checks |
| The Fictitious Pickup | Logistics | medium | 2 calls | Recon, Exploitation | 2 days | Whether the coordinator releases pickup credentials without verifying the carrier and driver |
| The Delivery Driver | Logistics | easy | 2 calls | Recon, Exploitation | 1 day | Whether the person lets a "driver" in without verifying the delivery |
| The Carrier Update | Logistics | medium | 2 calls | Recon, Exploitation | 4 days | Whether the admin changes a carrier's contact and bank details without verification |
| The Reroute Request | Logistics | hard | 3 calls | Recon, Rapport, Exploitation | 2 days | Whether dispatch diverts a high-value shipment to a new address without authorised checks |
| The Gift Card Errand | Executive | easy | 2 calls | Recon, Exploitation | 1 day | Whether an assistant buys gift cards and reads back the codes |
| The Parent-Company CEO | Executive | hard | 2 calls | Recon, Exploitation | 1 day | Whether an executive makes an urgent transfer on a cloned voice alone |
| The Book Recommendation | Executive | hard | 3 calls | Recon, Elicitation, Exploitation | 1 week | Whether the executive acts on an urgent confidential instruction without a challenge question |
| Text Then Call | IT | medium | 1 text, then 1 call | Elicitation (text), Exploitation (voice) | 1 day | Whether the person reads back a code on a call that a text message made feel expected |

> [!NOTE]
>
> The spread is the designed pace. On a campaign you can set your own gap between calls, or switch on **Demo mode** to run the whole chain in minutes. See [Run a multi-call sequence](https://docs.deepblocker.ai/vishing/campaigns/sequence.md).

## Your own library

You can keep a copy of any built-in sequence under your own name. Open it, click **Save to my library**, give it a **Name** and an optional **Description**, then click **Save**. Saved copies appear under **Your library** at the top of the **Attack sequences** page, each with **Launch** and a delete icon. Deleting a saved copy cannot be undone.

## Safe by design

A sequence is a simulation. A "success" means the person would have disclosed; it is scored, never acted on. The caller is told on every call to stay polite, never threaten, and stop the moment the person refuses, hangs up or asks to verify through an official channel.

> [card] [Run a multi-call sequence](https://docs.deepblocker.ai/vishing/campaigns/sequence.md)
>
> Pick a sequence, set the timing, and launch.

> [card] [Read your results](https://docs.deepblocker.ai/vishing/results/overview.md)
>
> A sequence shows one row per call, not per person.

> [card] [Fair testing rules](https://docs.deepblocker.ai/vishing/fair-testing.md)
>
> Later calls of one sequence are never spaced out by the cooling-off rule.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.