If you sequentially attack a subpopulation (e.g., employees at a company, senior citizens) the eventually news about your attack will spread throughout that network (internal security alert, evening news+daily newspapers+AARP+...). If you attack the entire subpopulation in rapid succession over the course of days or even hours, educational countermeasures become much less effective.
Restaurants make or break on one or two nights in a month. A calculated social engineering attack like this could bring down hundreds of restaurants in a city, which would cause millions of dollars in lost taxes, and you see where this is going.
You could write a screen scraper to book online through the various booking systems, but each booking system probably has its own restrictions on how many accounts you can have and how often they can book. You skip all of these protections when you phone your reservation in (arguably, the restaurant staff should be enforcing these protections when they pick up the phone, but restaurant staff are often overworked and apathetic).
Google Duplex can do the same thing - without even staffing a call center.
On the other hand, most of these places have online reservations which are already extremely gamed.
If you can automate it, your response rate only needs to be, what, like people clicking on spam? Tiny.
The days of trusting meat sacks with important information might be numbered.
Someone should make the dystopia where Skynet doesn't build terminators, but call centers.
Have you ever wondered the same thing about your favorite OS’s admin credentials dialog? What if an app spoofs it?
https://www.nytimes.com/2018/05/06/your-money/robocalls-rise...
I used the IRS example because the IRS never calls you. This is only known through experience, i.e. education.
> However, there are special circumstances in which the IRS will call or come to a home or business, such as when a taxpayer has an overdue tax bill, to secure a delinquent tax return or a delinquent employment tax payment, or to tour a business as part of an audit or during criminal investigations.
So the IRS might call if you owe taxes.
Surely moving from unsecured to a secured phone system can't be that big of a deal. In the US at least, we have experience something similar when we went from analog to digital television.
Add a secured mode of telephone calls and then telephone owners choose if they want to receive calls or messages from unauthenticated callers.