Vishing: phone scams that trick staff into giving access

What is vishing

Vishing is a form of social engineering where attackers use phone calls to steal information or money. The term is a combination of 'voice' and 'phishing.' Unlike email phishing, vishing allows the attacker to react in real-time to the victim's questions, making it a very persuasive method of fraud. A skilled vishing attacker can sound very professional, helpful, and convincing.

Attackers often impersonate authoritative figures such as IT support staff, bank employees, or government officials. By using a professional tone and technical jargon, they convince employees that there is a problem that needs immediate attention. The goal is to get the victim to lower their guard and provide information they would never share in an email.

Because many businesses have invested heavily in email security, attackers have pivoted back to the telephone. It is much easier to bypass a firewall with a phone call than with a malicious attachment. Vishing is particularly effective against front-desk staff, receptionists, and customer service teams who are trained to be helpful to callers.

How vishing attacks work

A vishing attack usually begins with a phone call that may appear to come from a local number or a known company. The attacker will use various psychological tactics to achieve their goal and prevent the victim from thinking clearly.

• Caller ID Spoofing: The attacker makes the call look like it is coming from your bank, your own company's IT department, or even a local police station.
• Creating Urgency: They claim your account has been hacked, that a 'critical system failure' is imminent, or that you are in legal trouble and must act now.
• Building Trust: They may already have some of your personal information, like your name, job title, or office location, which they use to sound legitimate.
• The Request: They ask for a password, a multi-factor authentication (MFA) code, or for you to install software that gives them remote access to your computer.

The IT help desk vishing scam

One of the most dangerous vishing scenarios involves the 'IT Help Desk' scam. An attacker calls an employee and says they have noticed a virus on their computer or that the company is performing a 'security audit.' They walk the employee through the process of 'fixing' the problem, which actually involves downloading software that gives the attacker full control of the machine.

Once the attacker has remote access, they can install ransomware, steal files, or use the computer to launch attacks on other systems within the company. This can happen in minutes, and the employee may not even realize anything is wrong until it is too late.

Voice AI and the future of vishing

Recent developments in artificial intelligence have made vishing even more dangerous. Attackers can now use AI to clone the voice of a specific person, such as a company executive or a trusted vendor. If an employee receives a call that sounds exactly like their boss, they are much more likely to comply with a fraudulent request, especially one that involves a financial transaction.

This makes it critical to have internal verification procedures that don't rely on voice alone. If a call involves a financial transaction, a change in payment details, or sensitive data, employees should have a way to verify the caller's identity through a separate channel, such as a video call or a face-to-face meeting.

How to protect your team from vishing

Protecting against vishing requires a culture of healthy skepticism. Employees should feel comfortable questioning callers and verifying their identity. You should also ensure that your staff knows that it is okay to 'be rude' and hang up on a suspicious caller.

1. Hang up and call back using a number you know is correct, like the one on the company's official website or your internal directory.
2. Never share multi-factor authentication (MFA) codes or passwords over the phone. No legitimate company will ever ask for these.
3. Report suspicious calls to your security or IT team immediately so they can alert the rest of the company to the threat.
4. Be cautious about sharing too much information on social media, as attackers use these details to make their calls sound more believable.
5. If a caller is overly aggressive or tries to pressure you, that is a major red flag. Legitimate support staff will be patient.