Vishing, short for voice phishing, is a scam that uses phone calls or voice messages to trick someone into handing over passwords, security codes, money, or sensitive information. The caller pretends to be someone you would trust, such as your IT department, your bank, a credit card company, a vendor, or a government agency, and creates enough pressure that you act before you think.
For businesses, vishing is dangerous because the phone feels more trustworthy than email. A voice sounds real, a caller can respond to your questions, and a confident caller who knows a few details about your company is hard to doubt.
Here’s how a vishing attack works, what it looks like in practice, and the habits that stop it.
What Is Vishing?
Vishing is phishing carried out by voice. Instead of a fake email, the attacker uses a phone call, a voicemail, or increasingly an AI-generated voice to impersonate someone and request personal information, login credentials, or a payment.
The FBI’s Internet Crime Complaint Center (IC3) defines phishing and spoofing as unsolicited email, text messages, and telephone calls, purportedly from a legitimate company, requesting personal, financial, or login credentials. So when IC3 reports on phishing, phone-based scams are part of the count.
Vishing is a form of social engineering: it manipulates people instead of breaking into systems. The goal varies. Some callers want personal or financial information such as account details, credit card numbers, or Social Security numbers, which can lead to identity theft. Others want something more valuable to a business: a password reset, an MFA code, remote access to a computer, or a wire transfer.
Related Topic: Build a Stronger Vulnerability Management Program
How Does a Vishing Attack Work?
Vishing techniques vary, but most attacks follow the same pattern. The goal of a vishing attack is simple: get a person to do the attacker’s work for them.
- Gather details. The attacker researches the target first. Company names, job titles, vendors, and employee names are easy to find on websites and social media. Some attackers make several calls, using early ones just to learn how your processes work, a classic social engineering technique.
- Place the call. The attacker calls, often with a spoofed caller ID so the phone number looks like it belongs to your bank, a coworker, or a known vendor. Caller ID spoofing commonly relies on voice over internet protocol (VoIP) services, which is why the number on your screen proves nothing.
- Apply pressure. This is the heart of it. The caller creates a sense of urgency: an account is about to be locked, a payment is overdue, the CEO needs something right now. Urgency is designed to stop you from slowing down to verify.
- Take access. The caller gets what they came for: a password, an MFA code, a reset, a remote-access session, or a wire transfer.
The whole thing can take a few minutes. Nothing has to be hacked in the traditional sense. A person just has to say yes.
Related Topic: Cybersecurity Risk Assessment: Identify and Reduce Security Risks
Vishing vs. Smishing vs. Phishing: What’s the Difference?
They’re the same trick on different channels. Most security guides group phishing into a handful of types: email phishing, spear phishing (aimed at specific people), smishing, and vishing.
| | Phishing | Smishing | Vishing |
| Channel | Email | Text message (SMS) | Phone call or voicemail |
| How it reaches you | A message with a link or attachment | A short text with a link or a number to call | A live or recorded call, often with a spoofed caller ID |
| Typical hook | “Your account needs verification” | “Delivery problem” or “unusual activity” | “This is IT” or “This is your bank,” always urgent |
| What the attacker wants | Credentials, payments, malware | Credentials, payments, malware | Passwords, MFA codes, resets, wire transfers |
| Best first defense | Email filtering and training | Don’t click; verify separately | Hang up and call back on a known number |
The channels often work together. An email or text creates a reason to call, and the call finishes the job. That’s why email security and phone habits both matter.
Related Topic: How a Virtual CISO Strengthens Your Cybersecurity Strategy
Examples of Vishing Scams
Consumer vishing gets most of the attention, but the examples that hurt businesses look different. These are the common vishing scams businesses actually see, and three types of vishing do the most damage:
IT help desk impersonation
A caller pretends to be an employee, or to be from IT, and asks the help desk to reset a password or move MFA to a new device. A joint advisory from the FBI and CISA (AA23-320A, updated July 2025) describes a criminal group doing exactly this: using voice communications to convince IT help desk staff to reset passwords and MFA tokens, often across several calls to first learn how the reset process works. The advisory also notes the group abuses contracted help desks, which is worth remembering if yours is outsourced.
Executive or vendor impersonation
A caller who sounds like the CEO or a regular vendor asks for an urgent wire transfer or a change to bank details. The FBI’s 2025 Internet Crime Report notes that voice cloning can be used to request wire payments, and that businesses reported losses of over $30 million to business email compromise scams involving AI.
Tech support and government impersonation calls
A caller claims there’s a problem with your computer, your account, or your taxes, or says they represent a government agency. IC3 describes two categories of call-center fraud, Tech/Customer Support and Government Impersonation, which together drew more than 80,000 complaints and more than $2.9 billion in reported losses in 2025. The report describes one call center dismantled in India in December 2025 whose operators impersonated U.S. agencies like the Drug Enforcement Administration and the Social Security Administration.
One caveat on the numbers: IC3 doesn’t report vishing as its own crime type, so no single figure isolates it. But the phone-based categories above show how much of this fraud happens by voice.
Related Topic: Penetration Testing Services: Find Security Weaknesses Before Hackers Do
Why Are Vishing Attacks Getting More Effective?
Two trends stand out.
Voice cloning. The FBI’s report notes that AI-enabled synthetic content is becoming harder to detect and easier to make. In practice, that means a voice that sounds exactly like your CEO or a regular vendor is no longer proof of anything.
Higher payoffs. According to IC3, phishing and spoofing complaints were essentially flat in 2025, but reported losses rose from about $70 million to about $216 million, roughly triple. The FBI doesn’t say why, but each successful attack is clearly costing victims more.
Related Topic: Supply Chain Cybersecurity Best Practices for Businesses
How to Recognize Vishing?
Vishing scammers lean on the same moves again and again, so a few warning signs help you recognize a vishing attack:
- Urgency or threats. “Your account will be closed today.” “I need this wire in the next hour.” Pressure is the signature move.
- Requests for secrets. Real IT staff and real banks don’t ask you to read out a password or an MFA code, or to share sensitive information over the phone.
- An unsolicited call. You didn’t initiate it, and it asks for something sensitive, sometimes framed as a way to “verify your identity.”
- A request to skip the process. “Just this once, we don’t have time to verify.”
- A request to install something. Remote-access software installed at a caller’s request is a common way attackers get in.
- Pressure to stay on the line. A legitimate caller won’t object if you hang up and call back.
Caller ID doesn’t count as a sign either way. It can be faked in both directions, so a familiar number is not reassurance and an unfamiliar one is not proof of fraud.
Related Topic: How to Achieve DFARS Cybersecurity Compliance
How to Prevent Vishing Attacks?
You can’t stop attackers from calling. You can make the call fail, and avoiding vishing mostly comes down to habits, not technology. The ones that work:
Call back on a number you already have
If a caller asks for anything sensitive, hang up and call the person or company back using a phone number from your own records, not one the caller gave you. This one habit defeats most vishing.
Set a verification rule for the help desk
A password or MFA reset should never be granted on an inbound call alone. Require a second check that doesn’t depend on the caller, such as a callback to a number on file or approval from the employee’s manager, and be especially strict on requests to move MFA to a new device. If your help desk is outsourced, make sure the contract spells out the same standard.
Use phishing-resistant multi-factor authentication (MFA)
CISA and the FBI recommend it in their advisory on voice-based help desk attacks. Unlike a code someone can be talked into reading aloud, it can’t be handed over on a phone call.
Add a second approval for money
Any change to bank details or any urgent wire request gets a callback to a known number and a second person’s sign-off, no matter who is asking.
Train for the phone, not just the inbox
Many security awareness training programs focus on email. Vishing needs its own practice: simulated vishing campaigns that place test calls to employees, and short scenarios where people rehearse what to say. We run customized tabletop exercises for clients, typically about 90 minutes once a year, and a phone-based vishing scenario with defined roles and unfolding developments is a strong fit for one. It’s also worth identifying your least technical employees. One small manufacturer we spoke with, a 17-person shop that runs mostly on email and phone, named its occasional computer users as its gap after a run of phishing attempts. Those are the people most likely to take an unexpected call at face value.
Make it easy to say no
Tell employees directly that hanging up and verifying is always the right call, even if the caller claims to be an executive, and encourage them to report suspicious calls even when nothing went wrong. Nobody should feel they have to be rude to the CEO to stay safe.
Prevention is one layer, alongside your technical security measures. The other is catching what slips through, which is where managed security services come in: monitoring that notices an account behaving strangely after a successful call.
Related Topic: Virtual CIO Services for Growing Businesses
What to Do If You’ve Experienced a Vishing Attack
Speed matters more than anything else.
- Stop and hang up. Don’t continue the conversation or follow any more instructions.
- Report it internally right away. Tell IT or your managed provider immediately. Quick reporting is not an admission of guilt.
- Reset what was exposed. Change any password that was shared, revoke active sessions, and review MFA devices for anything unfamiliar.
- Check the account. Look for new login locations, forwarding rules, or unusual messages sent from it. We cover why fast detection and containment matter so much in our guide to managed detection and response.
- If money moved, call your bank immediately. If you discover a fraudulent transfer, the FBI advises that time is of the essence: contact your financial institution right away to request a recall of the funds.
- File a report. The FBI asks victims to file a complaint at ic3.gov regardless of the amount, because the complaint can help the FBI and financial institutions freeze funds.
If you’re not sure your team would recognize a vishing call, or your help desk has no real verification rule, that’s the right place to start. Our team builds managed IT services around exactly this kind of practical, human-first security.
Learn about RightSentry Shield to see how monitoring and training work together to catch what a good caller gets through.
Related Topic: Virtual CIO Services for Growing Businesses
FAQ
What does the term vishing refer to?
Vishing combines “voice” and “phishing.” It refers to scams that use phone calls, voicemails, or AI-generated voices to trick people into sharing sensitive information or taking harmful actions.
What should you never say or share on a suspicious call?
Never share passwords, MFA or verification codes, account numbers, or personal details like Social Security numbers, and never confirm information a caller reads to you. Don’t follow instructions to install software or approve a login. Hang up, then contact the person or company using a number you already have.
What happens if I answer a call from a scammer?
Answering alone usually isn’t the danger. What matters is what you say or do next. Don’t confirm personal or company information, don’t follow instructions, and end the call. If you did share something, report it right away.
Can I trust caller ID?
No. Caller ID can be spoofed to display any number, including a coworker’s extension, a known vendor, or a government agency. Always verify by calling back on a number you already have.
Do vishing attackers use AI?
Increasingly, yes. The FBI’s 2025 report notes that voice cloning can be used to request wire payments, and that AI-enabled content is becoming harder to detect. A voice that sounds familiar is no longer proof of identity.
How do I report a vishing attack?
Report it to your IT team or managed provider immediately, and file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov. If money was sent, contact your bank right away to request a recall.
