Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

What is vishing? Voice phishing and how to defend

In one sentence: Vishing is phishing by phone call: a caller pretends to be someone you trust to get a password, a code or a payment from you.

What it is

Vishing is “voice phishing”. The Irish NCSC defines it as fraudulent voice phone calls and lists it with email phishing and smishing. The UK NCSC includes phone calls in its definition of phishing.

The caller claims to be from your bank, the police, a supplier, a government body or your own IT help desk. A calm, helpful voice is harder to doubt than an email, and caller ID can be faked, so a number that looks right proves nothing.

How it works

  1. The attacker gathers staff names, job titles and systems from websites, social media and earlier breaches.
  2. They call with a story: “I am from IT, we have detected a problem with your account.”
  3. They apply pressure. The NCSC’s warning signs apply to calls: claimed authority, a deadline, threats.
  4. They ask for something small: read out a code, visit a page, approve a phone prompt, reset an account.
  5. The code or password lets them log in to the real system.
  6. They repeat, using facts from one person to sound convincing to the next.

Who it affects and how badly

Help desks, finance teams and reception staff are classic targets because they are paid to help. Managed service providers are targeted because one MFA reset can open a customer’s network.

Sole traders get calls posing as the bank or a government body. Accountancy, legal and estate agency staff get calls about urgent payments. Care providers, schools and councils get calls posing as suppliers or IT. Larger organisations see calls aimed at the service desk.

Worst case: one call gives an attacker an account, then email, files and perhaps the network. For a regulated firm that can become a notifiable personal data breach.

Real examples

Twitter, July 2020. Twitter’s update says its social engineering targeted a small number of employees through a “phone spear phishing attack”, leading to access to internal support tools. Source: https://blog.x.com/en_us/topics/company/2020/an-update-on-our-security-incident

Twilio, June 2022. As reported by Bitdefender quoting Twilio’s investigation, an employee was socially engineered by voice phishing into giving credentials, and the attacker accessed contact information for a limited number of customers. Source: https://www.bitdefender.com/en-us/blog/hotforsecurity/twilio-reveals-hackers-compromised-its-systems-a-month-earlier-than-previously-thought

How to detect it

  • Ask staff to log every call that asks for a code, a password reset or a payment.
  • Review help desk tickets for password and MFA resets nobody requested.
  • In Entra, check Authentication methods changes in the audit log. In Google Workspace, review the admin audit log for 2-step verification changes.
  • Look for sign-ins from new places shortly after a reset.
  • Check phone logs for repeated calls from the same unknown numbers.

How to fix or prevent it

  1. Call back on a number you already hold before acting on any phone request.
  2. Give the help desk a written identity check, such as manager approval, before any password or MFA reset.
  3. Move staff to phishing-resistant MFA so a code read out over the phone is not enough.
  4. Tell staff no genuine bank, supplier or IT person will ask for a full password or one-time code.
  5. If in doubt, hang up and contact the organisation directly, as the NCSC advises.
  6. Practise with voice exercises so staff rehearse saying no politely.
  7. Remove blame. Staff who fear punishment report late.

Related terms

Browse all entries in the social engineering hub.

FAQ

What is the difference between phishing and vishing? Phishing usually arrives by email. Vishing is a phone call. Both are social engineering.

Can caller ID be trusted? No. The NCSC advises you to hang up and use official contact details.

Has vishing caused real breaches? Yes. Twitter in 2020 and Twilio in 2022 both reported phone-based attacks.

How Wolfcore helps

Phishy runs realistic phishing simulations against your own staff and shows you who clicked, so you can train the people attackers target. See Phishy phishing simulation.