One or more computer-readable media storing instructions that, when executed by one or more hardware processors, implement an authentication service, the stored instructions comprising: first instructions that, when executed, cause the authentication service to receive voice signals being delivered to a recipient; second instructions that, when executed, cause features of the received voice signals to be conveyed to a plurality of vishing detectors (340, 350, 360), and respective scores to be received from the vishing detectors; third instructions that, when executed, cause the authentication service to transmit a real-time notification of a vishing threat (370, 690) based on the received scores; fourth instructions that, when executed, implement a first one of the vishing detectors configured to: first analyze the received voice signals for tampering, by evaluating deep scattering spectra features (620, 870) and shifted delta cepstra features (622, 940) of a first voice signal among the received voice signals, to determine a measure of likelihood that the first voice signal has been tampered with; and generate a first score of the scores based on the measure of likelihood; and one or more of fifth and sixth instructions, wherein: the fifth instructions, when executed, implement a second one of the vishing detectors configured to second analyze the received voice signals for content associated with vishing (660, 662, 664), and to generate a second score of the scores based on the second analyzing; and the sixth instructions, when executed, implement a third one of the vishing detectors configured to compare a voice profile of the received voice signals with a stored voice profile (644, 365) of a purported speaker of the received voice signals, and to generate a third score of the scores based on the comparing. first instructions that, when executed, cause the authentication service to receive voice signals being delivered to a recipient; second instructions that, when executed, cause features of the received voice signals to be conveyed to a plurality of vishing detectors (340, 350, 360), and respective scores to be received from the vishing detectors; third instructions that, when executed, cause the authentication service to transmit a real-time notification of a vishing threat (370, 690) based on the received scores; fourth instructions that, when executed, implement a first one of the vishing detectors configured to: first analyze the received voice signals for tampering, by evaluating deep scattering spectra features (620, 870) and shifted delta cepstra features (622, 940) of a first voice signal among the received voice signals, to determine a measure of likelihood that the first voice signal has been tampered with; and generate a first score of the scores based on the measure of likelihood; and one or more of fifth and sixth instructions, wherein: the fifth instructions, when executed, implement a second one of the vishing detectors configured to second analyze the received voice signals for content associated with vishing (660, 662, 664), and to generate a second score of the scores based on the second analyzing; and the sixth instructions, when executed, implement a third one of the vishing detectors configured to compare a voice profile of the received voice signals with a stored voice profile (644, 365) of a purported speaker of the received voice signals, and to generate a third score of the scores based on the comparing. first analyze the received voice signals for tampering, by evaluating deep scattering spectra features (620, 870) and shifted delta cepstra features (622, 940) of a first voice signal among the received voice signals, to determine a measure of likelihood that the first voice signal has been tampered with; and generate a first score of the scores based on the measure of likelihood; and one or more of fifth and sixth instructions, wherein: the fifth instructions, when executed, implement a second one of the vishing detectors configured to second analyze the received voice signals for content associated with vishing (660, 662, 664), and to generate a second score of the scores based on the second analyzing; and the sixth instructions, when executed, implement a third one of the vishing detectors configured to compare a voice profile of the received voice signals with a stored voice profile (644, 365) of a purported speaker of the received voice signals, and to generate a third score of the scores based on the comparing.