AI-powered scam simulator: NYP grad turns final-year project into cyber-security solutions business

“Hi, this is Daniel calling from the bank. I need to alert you about some suspicious transactions detected in your account.”

Those who frequently receive scam calls – particularly from giveaway stilted, unnatural-sounding robocallers – usually hang up instantly.

But a convincingly Singaporean accent and conversational tone may lead some to fall for the scam and follow the caller’s instructions.

Fortunately for those attending workshops or roadshows by Virage, the entire conversation that follows the opening line above is just a simulation.

Virage, an AI-powered phishing and vishing simulation platform, is the brainchild of Nanyang Polytechnic (NYP) classmates Rohan Senthil, 20, and Xavier Woon, 20.

Phishing, typically carried out via e-mails, texts or links, tricks victims into divulging personal information. Vishing, or voice phishing, does the same over phone calls.

The duo developed the platform for their final-year project (FYP) in their diploma in cyber-security and digital forensics programme, and almost immediately turned it into a business venture.

“As we were doing the project, we always had the intention to turn it into a company, so we worked at a very quick pace,” said Mr Senthil, who graduated on May 6 with a grade point average of 4. 

The pair finished their FYP in just a month, by December 2024, and with the help of business and financial technology student Ezekkious Loo, 21, showcased their platform at various technology-related events in January 2025. They also registered their start-up, Virage Cybersecurity, on Feb 3 this year. 

Similar to other cyber-security companies in the industry, Virage offers e-mail phishing simulation campaigns to their commercial clients. With a short description of the scam scenario, the artificial intelligence software will generate the e-mail content, which is sent to the employees of their client, to test their company’s security readiness.

What makes Virage stand out, however, is its use of vishing campaigns.

The concept of a vishing simulation platform was inspired by Mr Senthil’s volunteering experiences when conducting classes where seniors could learn about online scams so they can better protect themselves. These were part of the Cyber Security Agency of Singapore’s (CSA) Cyber Safe Seniors Programme and the Infocomm Media Development Authority’s (IMDA) digital literacy workshops in 2024.

He recalled the confused looks on the elderly residents’ faces when he verbally explained advancements in scam techniques, such as deepfakes.

“Sometimes scam-prevention lessons can be a bit dry. Even if I told the elderly to look out for various indicators of scams, they could not picture what I was explaining, so many of them seemed disengaged,” he said.

He felt there was a better way of teaching scam prevention, by letting people experience what it was like to be on the receiving end of scam calls. This sparked the idea of using AI to simulate the voices of scam callers, which led to his developing an AI-powered vishing simulation platform.

“When a user responds to the voice of the scam caller in the simulation, their input is sent to the AI model, which generates a realistic reply by predicting the most contextually appropriate response, based on patterns it has learnt from training data,” Mr Senthil explained.

The technical process of creating the AI voice simulation was relatively simple, as the team adopted large language models online that were accessible by public users and modified them for better performance, rather than creating their own from scratch, to save time. 

As few “Singaporean-sounding” voices were available online for adaptation, Mr Senthil enlisted schoolmates and friends so he could “create scripts and record (their) voices for hours” to clone their voices into the platform. 

To mimic the moves of scam callers, Mr Senthil read books on social engineering, such as The Art Of Deception by the late Kevin Mitnick, a world-famous hacker-turned-cyber-security expert. He wanted to understand the tactics scammers use to obtain information, such as invoking a sense of urgency and establishing authority.

“We also referred to the monthly scam bulletins published on the ScamShield website by the Singapore Police Force and the National Crime Prevention Council, which showed monthly scam statistics and increasingly prevalent scams to look out for,” he added.

The team also represented NYP in showcasing their platform at AI Festival Asia, a two-day event in January hosted by the Association of Small and Medium Enterprises and the Lifelong Learning Institute.

A Jan 17 report in The Straits Times that mentioned their start-up caught the interest of a cyber-security company, which became their first commercial client.

Corporate clients can subscribe to Virage services that “test” employees’ vulnerability to phone scams. Unsuspecting employees would receive a call from an internet-based phone number, to check if they would unwittingly disclose sensitive information.

“The data from these simulations allows the companies to assess their level of ‘human risk’,” said Mr Senthil. Such vulnerability assessments could be used by companies to attain certifications under the Cyber Trust mark, a national cyber-security certification offered by CSA.

Mr Senthil added: “The weakest link in any system is humans. Whether it is clicking on one wrong e-mail or picking up a scammer’s call, human errors provide the entry points for cyber attacks to happen. This is why education and awareness on scams will always remain important.”

While waiting to enlist for national service, Mr Senthil is working full-time on the start-up, which has expanded to a core team of seven members. Four were his schoolmates from NYP who specialise in various fields like AI, cyber security, information technology and infocomm security, and support the app’s front-end and back-end development.

Mr Senthil was the vice-president of NYP’s technopreneurship club and kick-boxing club, and was also in the information security club.

He received the Lee Kuan Yew Award for Mathematics and Science this year for his academic excellence, as well as the Ngee Ann Kongsi Award for All-Round Achievement, for his holistic performance in his studies, leadership and community service. 

As a Digital for Life partner with IMDA, Virage also organises workshops and participates in roadshows on scam prevention, where people can try the AI vishing simulator and see how they fare under various scam scenarios.

The team updates their scam scenario options regularly based on emerging scam trends, such as adding an “Elections Department voter registration” scenario during the recent general election. About 1,000 people have tried their platform so far.

“They were quite amazed at how realistic the voice is, some people even wondered if it was an actual person calling them,” Mr Senthil said.

Correction note: An earlier version of the story said that Virage further recruited four of Mr Senthil’s NYP juniors as part of their core team. This has been corrected to four of his NYP schoolmates.