I’ve been in business communications long enough to remember when the worst thing a phone call could do to a company was waste somebody’s afternoon. Now, things have changed.
Picture this. Your Google listing is about to expire. A vendor changed his bank details. An invoice you’ve never heard of is suddenly overdue. Somebody at the front desk takes the call, then the next one, and somewhere in the pileup a real customer gets a busy signal.
For most of my career, that was the spam call problem: a tax on attention, paid in small installments. Annoying, expensive in aggregate, mostly harmless one call at a time. The industry has built call-blocking tools to collect that tax back, and they’ve done a respectable job of it.
That’s no longer the whole story. Over the last couple of years, attackers figured out that we built a fortress around email and left the phone to be answered by the most helpful people in the building.
Which brings me to The Who. The title track of their 1978 album asks one question, over and over: who are you? It’s the only question that matters on a business phone line in 2026, and most phone systems never ask it.
A spam call is any unwanted inbound call your business didn’t ask for: robocalls, non-consensual telemarketing, scam calls, and calls from spoofed numbers. For businesses, this now includes vishing (voice phishing), where a live caller (or a cloned voice) impersonates someone trusted to get credentials or direct access to money.
Think of it as a set list. Opening the show, you’ve got the robocalls, the auto-warranty pitches, and the fake listing renewals. They’re noise. They waste staff time, tie up lines, and bury real customers, which is its own customer experience problem.
Vishing closes the show with a targeted call designed to talk someone into doing something they shouldn’t, like resetting a password or approving a payment.
Both share the stage and ride the same phone lines, often from the same kinds of disposable numbers. The difference is intent, and intent doesn’t show up on caller ID.
The numbers here aren’t subtle. Google’s Mandiant M-Trends 2026 report found that voice phishing climbed to 11% of initial infection vectors in 2025, second only to software exploits. Email phishing fell to 6%, down from 14% the year before. Read that again: in the breaches Mandiant investigated, attackers got in by phone almost twice as often as by email.
And the curve is still climbing. CrowdStrike’s 2025 Global Threat Report logged a 442% jump in vishing between the first and second halves of 2024. Its 2026 Threat Hunting Report says vishing intrusions doubled again in the first half of 2026 compared with the second half of 2025.
Palo Alto Networks’ Unit 42 found that 36% of the incident response cases it handled between May 2024 and May 2025 began with social engineering. Not a firewall failure. A conversation.
The help desk is the target
The call rarely goes to the main number. It goes to the help desk, the front desk, the clinic scheduler. The people in those seats are good at their jobs (trust me, they are), and that’s exactly the problem. A help desk exists to help. Someone paid to be helpful, on the phone with a caller who sounds stressed and sure of themselves, isn’t a security control. They’re a target.
The play runs both directions. Attackers call the help desk pretending to be locked-out employees, and they call employees pretending to be the help desk. Sometimes the nuisance and the attack even travel together: CrowdStrike has documented spam bombing, where attackers flood an inbox with junk so a fake IT support call offering to fix it feels perfectly reasonable.
MGM Resorts learned how this ends in 2023. One call to the IT help desk to reset multifactor authentication, and the company’s SEC filing estimated the hit at roughly $100 million.
The voice can lie, too
Then there’s the voice itself. Back in 2023, Microsoft researchers showed their VALL-E model could imitate a speaker from a three-second recording. Three seconds. That’s shorter than the count-in on most records, and a lot shorter than your CFO’s voicemail greeting. “I recognized the voice” is no longer a verification step.
Most call protection works like a ticket scanner at the venue door. Carrier spam labels, reputation scores, and blocklists all check the same thing: is this number on the list of known troublemakers? For known junk, that works well. The key word there is known.
The Do Not Call Registry won’t save you either. Honest telemarketers respect it, most business-to-business calls are exempt from it, and criminals don’t read it.
Then there’s the keypad test: “Press 1 to be connected.” That proves a hand is present. It doesn’t prove whose hand, or why it dialed.
Here’s the pattern. The obviously good calls ring through. The obviously bad ones die quietly. The trouble lives in the middle, with calls that look fine on paper and sound fine on the line. And nobody in that whole chain ever asks the one question that matters.
AI call screening puts an automated agent between the caller and your staff. Calls that are clearly legitimate ring straight through, known spam gets blocked, and for the uncertain middle, the AI agent answers first, finds out who’s calling and why, then connects the call or ends it.
Back to the venue for a second. A blocklist is the ticket scanner. AI call screening is the stage manager who walks up to the stranger by the backstage door and asks, “Who are you, and who are you here to see?” before anybody lets them through.
That’s how ConnectAI Shield works. Shield sits between your carrier and your phone system, so every call gets checked before anything rings. It looks at caller ID, spam-number lists, and call floods, and each customer starts with 15 million known bad numbers on day one. From there, every call lands in one of three lanes:
Shield also learns your trusted callers from your own traffic and carries that knowledge to new sites, so the screening gets sharper the longer it runs. It’s automated call screening that does the asking, which means your people stop being the first line of defense. They were never supposed to be.
Shield protects incoming calls. That’s the job. It doesn’t replace help desk verification or multifactor authentication, and anyone who tells you one product replaces those is selling something. (We’re also selling something. We’re just telling you where it stops.)
Think of Shield as one layer in a zero trust approach to communications: never trust, always verify, now applied to the phone. Pair it with a help desk that confirms identity out of band, like a callback to the number on file rather than the number the caller offers. Shield’s role is to make sure far fewer suspicious calls ever reach the people those procedures depend on.
The number that matters most isn’t in any threat report. It’s the traffic on your own lines, and most organizations have never counted it.
So before anyone buys anything, we’ll run a free Pulse analysis on a month of your call records. It shows how much of your traffic is junk, when it arrives, and where you’re exposed. Then you decide what, if anything, to do about it.
The Who recorded a lot of great songs, but the title I’d leave you with is “Won’t Get Fooled Again.” That’s the goal here. Not a phone system that never rings, but one that knows who’s on the line before your people pick up.
Many spam calls are illegal in the US. The Telephone Consumer Protection Act restricts unconsented robocalls and autodialed calls, and the Truth in Caller ID Act bans spoofing a number to defraud or cause harm. Scammers ignore both, so prevention matters more than enforcement.
You can report illegal robocalls and spoofed calls to the FTC or the FCC.
The National Do Not Call Registry offers business lines little protection. It’s built for personal numbers, most business-to-business calls are exempt, and criminals never check the list anyway. Businesses need filtering at the network or phone-system level to stop spam calls.
A spam call is any unwanted call, from robocalls to telemarketing. Vishing, or voice phishing, is a targeted spam call where a live or cloned voice impersonates someone trusted to steal credentials, money, or access. Spam wastes time; vishing aims to cause a breach.
AI call screening shouldn’t block real customers when it’s tuned to your traffic. Known good callers ring straight through, and uncertain callers get a short conversation with an AI agent instead of a hang-up, so a legitimate caller is connected rather than lost.
ConnectAI Shield learns your trusted callers from your own traffic, so the customers and partners who call you regularly ring straight through.
Spam call blocking costs depend on how many sites, lines, and calls a business handles and how much screening it needs. Basic carrier filters are often bundled in. Advanced AI call screening is scoped to real traffic, so start by measuring your own call records.
Continuant’s free Pulse analysis does that measuring for you, using a month of your call records. Connect with us today to get started.