What is vishing?
Definition
Vishing, short for voice phishing, is a scam where someone phones or leaves a voice message pretending to be a bank, company or agency to trick you into giving up money, codes or personal details.
- Category
- Scams
- Also called
- voice phishing, phone scam
- Last updated
Vishing is phishing by voice. The caller reaches you by phone or voicemail and uses a story to get something out of you: a one-time code, your card details, a transfer or access to your computer. CISA describes it as the social engineering approach that uses voice communication.
Why people fall for it
A voice feels more trustworthy than an email, and a caller can push you in real time. CISA points out that internet-based calling makes it easy to fake the caller ID, which can take advantage of people's trust in phone calls, so the number on your screen proves little. The FBI's Internet Crime Complaint Center warns that vishing may now use AI-generated voices, and that voice cloning can sound nearly identical to a real contact. It advises listening closely to tone and word choice, and not treating a familiar voice as proof.
A typical call
A "fraud department" calls and says there is suspicious activity on your account. To "protect" you, they ask you to read out the code your bank just texted you. That code is the attacker logging in as you. Another version pretends to be a relative in trouble, a delivery company or a tech support agent.
Details that make it believable
Callers often already know your name, address or the company you bank with. Where that comes from is partly public: people-search sites and leaked data put names, phone numbers and addresses side by side.
Vishing vs. related terms
- Smishing is the same attack by text message.
- Phishing is the general term, usually email.
- Spoofing is faking the number or name you see, which vishing callers often use.
- Spear phishing is a targeted version that uses details about you.
How to protect yourself
- 1
Hang up and call back on a number you trust
Use the number on your card, your statement or the official website. Don't use a number the caller gives you.
- 2
Never read out a one-time code
A real company won't ask you for a code that was sent to you. Anyone asking for it wants to log in as you.
- 3
Agree a family code word
Because voices can be cloned, a word only your family knows helps you check an urgent call from a relative.
- 4
Don't let anyone take over your computer or phone
Refuse remote access requests from callers, however official they sound.
- 5
Make your number harder to find
Scammers use lists of phone numbers and names. Serus finds where your address and phone number are listed and removes them, which cuts down the details a scammer can use to make a message sound personal.
- 6
Report the call
In the US, report it at ReportFraud.ftc.gov, and to the FBI at ic3.gov if you lost money or data.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What is the difference between vishing and phishing?
Phishing is the general fake-message attack, usually by email. Vishing uses phone calls or voice messages.
What should I do if I gave information to a vishing caller?
Contact your bank or the company straight away on an official number, change any passwords you shared and turn on two-step verification. Report it to the FTC and, if money was lost, to the FBI at ic3.gov.
Can scammers fake the number that calls me?
Yes. CISA notes that internet calling makes caller ID easy to spoof, so a familiar or official-looking number isn't proof of who is calling.
Sources
Something wrong or out of date? Tell us and we'll re-check it.