Vishing (voice phishing) is a social engineering attack carried out by phone, in which criminals pose as a bank, support team, police or colleague to obtain money, passwords or access.
How vishing works
Vishing combines classic phone fraud with the techniques of phishing. Callers use caller ID spoofing so that the bank’s real number appears on screen, prepare a believable script and create urgency: “suspicious transactions on your account”, “your computer is infected”, “we need to verify your identity right now”. Common scenarios include:
- fake bank “security service” asking for card details or one-time codes;
- tech support scams that persuade victims to install remote access tools;
- calls to a company’s IT help desk impersonating an employee to reset a password or MFA device;
- automated “OTP bots” that call victims to collect two-factor codes.
Why vishing matters
Voice calls feel personal and leave little time to think, which makes social engineering very effective. Vishing against help desks has become a major attack vector for companies: in 2023 the Scattered Spider group breached MGM Resorts after calling the help desk and posing as an employee. Deepfake voice cloning now lets attackers imitate a real manager’s voice.
How to protect yourself
- Hang up and call back using the official number from the bank’s website or card.
- Never share one-time codes, passwords or card PINs by phone – banks do not ask for them.
- Companies should require strict identity verification before help-desk password and MFA resets.
- Agree on code words for urgent financial requests within the company or family.
