Vishing

Vishing Definition

Vishing (voice phishing) is a form of fraud — a phone scam — in which attackers use phone calls to extract confidential information from victims. Vishing combines social engineering techniques with voice communication to convince victims to reveal personal, financial, or other sensitive information.

How Does Vishing Work?

• Phone contact: Attacker calls the victim, impersonating a trusted institution such as a bank, technology company, or government agency.
• Fraud scenario: Attacker presents a false scenario, e.g., a problem with a bank account, security threat, or promotional offer.
• Call to action: Victim is asked to provide confidential information such as credit card numbers, passwords, or login credentials.
• Data exploitation: Collected information is used for identity theft, bank account takeover, or other criminal activities.

Types of Vishing Attacks

• Fake bank notifications: Attacker impersonates a bank, informing about an alleged account problem.
• Technical scams: Attacker impersonates technical support, claiming the victim’s computer is infected.
• Tax-related scams: Attacker impersonates tax authorities, threatening sanctions for alleged tax arrears.
• Prize-related scams: Victim receives information about winning a contest but must provide personal data to claim the prize.

Vishing Examples

• Phone call from “bank” asking to confirm account details to resolve a problem.
• Conversation with “technical support employee” informing about an infected computer and requesting remote access.
• Phone call from “tax office” threatening sanctions for unpaid taxes and requesting immediate payment.
• Fake notification about winning a lottery, requiring personal data to claim the prize.

Threats Associated with Vishing

• Identity theft: Gaining access to victim’s personal data.
• Financial theft: Bank account takeover and theft of funds.
• Malware installation: Gaining access to victim’s computer and installing malware.
• Privacy violation: Interception of confidential personal and professional information.
• Blackmail: Using collected information to blackmail the victim.

How to Recognize a Vishing Attack?

• Unknown phone number: Calls from unknown or suspicious numbers.
• Urgent call to action: Requests for immediate action, such as providing personal data.
• Unexpected requests for confidential information: Demands for credit card numbers, passwords, or login credentials.
• Threats and pressure: Using threats or pressure to convince victim to reveal information.
• No identity verification: Inability to verify caller’s identity.

Protection Methods Against Vishing

• Identity verification: Always verify caller’s identity by calling back on a known institution number.
• Not providing confidential information: Never provide confidential information by phone unless you are certain of the caller’s identity.
• Using call blocking: Blocking suspicious phone numbers.
• Reporting suspicious calls: Reporting suspicious calls to appropriate institutions.
• Education and awareness: Regular training and raising awareness about vishing-related threats.

Differences Between Vishing and Other Phishing Forms

• Vishing: Uses phone calls to extract information.
• Phishing: Uses emails to extract information.
• Smishing: Uses SMS messages to extract information.
• Spear phishing: Targeted phishing, often directed at specific individuals or organizations, using personalized messages.

Vishing Trends 2025-2026

Deepfake Audio (AI Voice Cloning)

The biggest change in the vishing landscape - attackers use AI to clone voices:

Aspect	Traditional Vishing	Deepfake Vishing
Voice	Actor/scammer	Cloned voice of known person
Credibility	Medium	Very high
Detectability	Easier	Very difficult
Preparation time	Minutes	Minutes (with AI)
Cost	Low	Low (AI democratization)

Typical deepfake vishing scenarios:

• “CEO” calls accounting with urgent transfer request
• “Son/daughter” asks parent for financial help
• “Bank” confirms identity before “transaction”

2024-2025 Statistics

• Significant increase in vishing attempts in financial sector
• Record loss from a single vishing attack (deepfake CEO)
• 3 seconds of audio is enough to clone a voice
• The vast majority of people cannot distinguish deepfake audio from real

Callback Phishing (Hybrid Vishing)

New tactic combining email with vishing:

1. Victim receives email with fake invoice
2. Email contains phone number for “clarification”
3. Victim calls - reaches scammer call center
4. “Consultant” extracts data or installs malware

Protection Against Deepfake Vishing

For organizations:

• Code words: Establish verification passwords with supervisors
• Callback policy: Call back on known numbers (not from email/SMS)
• Dual approval: Require two people to authorize transfers
• AI detection tools: Tools detecting synthetic voice

For individuals:

• Agree on a “security password” with family
• For urgent money requests - always call back on known number
• Ask questions only the real person would know the answer to

Related Terms

• Phishing - email scams
• Smishing - SMS scams
• Social Engineering - manipulation techniques
• Deepfake - voice and image cloning technology
• Security Awareness - protection through education

Explore Our Services

Want to protect your organization from vishing? Check out:

• Social Engineering Testing - vishing and phishing simulations
• Security Awareness Training - voice attack recognition education
• SOC 24/7 - monitoring and incident response

Vishing is a serious threat in today’s digital world, and deepfake technology makes attacks increasingly difficult to detect. The key to protection is threat awareness, established verification procedures, and regular employee training.