What is Vishing?

Vishing (voice phishing) is a social engineering attack using phone calls to manipulate victims into revealing sensitive information or performing harmful actions.

What is vishing?

Vishing (voice phishing) is a social engineering attack where threat actors use telephone calls to manipulate victims into divulging sensitive information, transferring funds, or performing actions that compromise security. Attackers impersonate trusted entities including banks, tech support, government agencies, or company executives, exploiting the perceived authenticity and urgency that voice communication conveys compared to text-based phishing attacks.

How do vishing attacks work?

Vishing attacks typically begin with caller ID spoofing to display trusted phone numbers, followed by a scripted pretext impersonating a legitimate authority. Attackers create urgency through claims of account compromise, legal issues, or IT emergencies. They guide victims through revealing credentials, installing remote access software, transferring funds, or providing verification codes. Advanced vishing campaigns use background noise generators and AI-generated voice deepfakes for authenticity.

What are common vishing pretexts?

Common vishing pretexts include bank fraud department alerting about suspicious transactions, IT support requesting credentials for urgent system maintenance, government agencies threatening legal action over tax issues, executive impersonation requesting wire transfers (CEO fraud), tech support claiming malware detection requiring remote access, insurance companies requesting policy verification, and healthcare organizations requesting identity confirmation for records access.

How do you defend against vishing?

Defend against vishing through employee security awareness training covering voice-based social engineering tactics, establishing call-back verification procedures using independently sourced phone numbers, implementing code words for internal requests, deploying voice authentication systems, creating escalation procedures for suspicious calls, instituting multi-person authorization for financial transactions, and conducting regular vishing simulation exercises to test organizational resilience.

How has AI changed vishing attacks?

AI has transformed vishing through deepfake voice technology that clones the voices of executives, colleagues, or family members using brief audio samples. AI-powered real-time voice changing enables attackers to sound like anyone during live calls. Large language models generate convincing scripts adapting to victim responses. These advances make vishing attacks significantly more convincing and harder to detect through traditional voice recognition and social engineering awareness.

How do penetration testers conduct vishing assessments?

Penetration testers conduct vishing assessments by developing realistic pretexts relevant to the target organization, making controlled calls to employees following ethical guidelines and engagement rules, documenting information disclosed and actions taken, measuring organizational resistance to voice-based social engineering, and providing detailed findings with specific training recommendations. Results quantify human-factor vulnerability to voice-based attacks against established policies.

What is the relationship between vishing and BEC?

Vishing frequently supports Business Email Compromise (BEC) campaigns. Attackers may call to verify email addresses before sending targeted phishing, follow up phishing emails with phone calls to increase credibility, use vishing to convince employees to act on fraudulent email instructions, or impersonate executives via phone to authorize fraudulent wire transfers. The combination of voice and email channels creates highly convincing multi-vector social engineering attacks.

How do you report vishing attempts?

Report vishing attempts to your organization's security team immediately, documenting the caller's claimed identity, phone number displayed, information requested, and any details provided before recognizing the attack. File reports with the FTC (Federal Trade Commission), FBI IC3, or equivalent national authorities. If financial information was disclosed, contact your bank immediately. Organizational reporting enables pattern identification and targeted awareness training improvements.