Vishing (Voice Phishing)
What is Vishing?
Vishing (short for voice phishing) is a social engineering attack conducted over telephone networks. Unlike traditional email phishing where you can inspect suspicious links and headers at your own pace, vishing exploits real-time psychological pressure, authority impersonation, and panic.
Attackers frequently spoof legitimate caller IDs so your phone screen displays the actual name or number of your bank's fraud department, local police, or corporate IT helpdesk. Advanced threat actors also deploy AI voice cloning ( deepfakes) replicating the tone and cadence of executives or loved ones.
How Attackers Operate
Attackers rely on emotional manipulation—typically fear, urgency, or helpfulness—to override rational critical thinking.
- Target Intelligence (OSINT): The caller acquires basic personal details from data leaks, LinkedIn, or social media (your full name, employer, banking institution, or phone provider).
- Caller ID Spoofing: Attackers configure VoIP software to display a legitimate number—such as your bank's published 24/7 client hotline or police department.
- Manufactured Crisis: The scammer reports that your bank account is "under active attack", unauthorized loans are being approved, or your computer has malware.
- The "Safe Account" or Remote Access Trap: The victim is instructed to immediately transfer all funds to a "secure reserve vault" or install remote support software (AnyDesk, TeamViewer) to "clean the machine".
- Fund Extraction & Disappearance: Once transferred or logged in, the funds are instantly laundered through cryptocurrency exchanges or offshore mule networks.
Real-World Simulation
Here is what a typical high-pressure banking vishing dialogue sounds like:
"Good morning Mr. Anderson. This is Marcus from the Cybersecurity Operations Center at your bank. We are detecting an unauthorized wire transfer of $8,400 to an offshore account in Vienna right now.
To prevent this transaction from settling, I need you to confirm the 6-digit one-time code we just dispatched to your mobile phone. Do not hang up—if you disconnect, the funds will irreversibly leave your account."
How to Defend Yourself
The golden rule of incoming phone security is simple: never verify a caller using the inbound call itself.
- Hang up and verify independently: Never continue a high-stakes call initiated by someone else. Hang up, wait 30 seconds (or restart the line), and dial the official phone number printed on the back of your payment card or official company directory.
- Banks never ask for full credentials or 2FA codes: Legitimate bank employees will never ask for your login passwords, card PIN, CVC/CVV security code, or push authorization approvals over the phone.
- Beware of "Safe Deposit Accounts": Banks never instruct clients to transfer money into an alternative or temporary "reserve vault" account to protect it.
- Never install remote control software on request: If a caller asks you to install AnyDesk, TeamViewer, RustDesk, or QuickSupport, hang up immediately.
- Establish internal verification protocols: For corporate calls asking for financial transactions or credentials, require dual-channel out-of-band verification.
Immediate Actions If Targeted
If you suspect you have disclosed financial data or authorized a fraudulent transaction during a phone call:
- Immediately contact your bank's official fraud line: Request immediate card blocking, internet banking session termination, and transaction recalls. Every minute matters for wire recall requests.
- Change all passwords from an uninfected device: If you installed software or entered passwords on suggested links, assume your workstation is compromised. Change passwords and revoke active sessions.
- File a report with law enforcement (Police): Document the attacker's phone number, time of call, claimed identity, and transaction identifiers.
- Notify your company's IT / Security Operations (CISO): If corporate credentials or workstations were involved, report the incident immediately so credentials can be rotated and endpoints isolated.
Resources & References
- Komerční banka – Podvodné telefonáty (Vishing) – Guide on spoofed bank calls and caller verification.
- Czech Banking Association – #NePINdej! Campaign – Educational nationwide campaign on banking fraud and social engineering.
- CISA – Avoiding Social Engineering and Phishing Attacks – Voice phishing and imposter call defense.
- MITRE ATT&CK – Technique T1566.004: Spearphishing Voice – Adversary methodology for vishing operations.
Phishing (Credential Harvesting & Scams)
Deceptive emails, text messages, or direct communications designed to trick users into revealing confidential credentials, banking details, or downloading malware via lookalike websites.
Ransomware & Malicious Attachments
Malicious software that encrypts vital business files, databases, and backup systems, demanding enourmous cryptocurrency ransoms under threat of permanent data destruction or public leaks.