Vishing is phishing over the phone: a caller impersonates someone you trust — IT support, your bank's fraud team, a supplier, even your own CEO — and talks you into handing over credentials, one-time codes or a payment. The name blends voice with phishing, and the goal is identical to email phishing and smishing: get a person, not a computer, to hand over the keys.
TL;DR
- Vishing is voice phishing — a phone call (or voicemail) that impersonates a trusted person or organisation to extract credentials, codes or money.
- It is the hardest of the three phishing channels to filter: no email to scan, no link to detonate, just a voice applying urgency and authority.
- Voice and SMS breach vectors averaged USD 5.29 million per breach in IBM's 2026 Cost of a Data Breach Report — among the most expensive breach types measured.
- The defence is a verification habit: hang up, call back on a number you already had, and never read out a one-time code.
What is vishing?
Vishing (voice phishing) is a social-engineering attack delivered by phone call or voicemail. The caller poses as an authority your staff already deal with — an IT help desk resetting a password, a bank investigating suspicious transactions, an executive assistant chasing an urgent payment — and uses pressure to extract what they want: a login, an MFA code, new payment details or a transfer.
It sits alongside its sibling channels in the same attack family:
| Channel | Name | Why it works |
|---|---|---|
| Phishing | Volume; trusted-brand lures with fake links | |
| SMS | Smishing | No sender domain to check; lands beside real service texts |
| Voice | Vishing | Real-time pressure; caller ID spoofing; no artefact to scan |
How a vishing attack actually works
- Reconnaissance. The caller knows enough to sound real: your company name, a recent invoice, a staff member's name from LinkedIn. AI voice cloning, built from seconds of a public video, has removed the accent-and-awkwardness tell that used to give these calls away.
- The pretext. A plausible reason to call: an unusual sign-in on your account, a payment that failed, a software licence expiring today.
- The pressure. Urgency plus authority: act now, and the person asking outranks your doubt. A spoofed caller ID can even display your bank's real number.
- The extraction. The target reads out a one-time passcode, approves a push prompt, changes payment details or initiates a transfer — actions that feel like cooperation but are the entire breach.
- The pivot. One set of credentials unlocks the real mailbox, and the next attack — invoice fraud, payroll diversion — runs from inside.
Why phone scams still beat technology
There is nothing for a security tool to intercept at the moment of the call: no attachment to sandbox, no URL to check. Caller ID is trivially spoofed, and generative AI has made the caller's voice indistinguishable from the real person's. That is why the human element keeps dominating breach statistics — Verizon's 2026 Data Breach Investigations Report attributes 62% of breaches to a human element — and why the phone, the most human channel of all, remains a preferred weapon.
The cost when it works is severe. IBM's 2026 Cost of a Data Breach Report put voice and SMS breach vectors at an average of USD 5.29 million per breach, above many purely technical intrusions — because by the time a vishing call succeeds, the attacker usually holds live credentials rather than a fragile foothold.
Red flags of a vishing call
- Unrequested urgency. A call that says the account will be locked, the transfer will fail or the fine will double within the hour. Real institutions can wait for a call-back.
- A request for a code or password. No legitimate help desk, bank or IT team ever needs your one-time passcode read aloud. This request alone ends the call.
- A call-back number supplied by the caller. Verification only works on a number you source yourself — the card, the website you type, the internal directory.
- Refusal of process. Legitimate finance and IT processes survive a verification step; scammers need you to skip it.
- The executive twist. The boss calling directly, discreetly, after hours, asking for a quick payment. Deference plus urgency is the classic executive-impersonation pattern.
The habit that defeats it: hang up and call back
The single control that breaks almost every vishing script is a call-back on a number you already had. If IT calls, ring the help desk on its published number. If the bank calls, ring the number on the back of the card. If the CEO calls about an urgent payment, ring their mobile or walk to their office. Thirty seconds of friction defeats an attacker whose entire advantage was staying on the line.
That habit is trainable. Voice-based phishing drills give staff safe practice at hanging up and verifying, and anyone who gets caught lands in a short remediation module the same week. Phishing simulations on the Cyber Aware platform extend that same practice loop across email lures, so the verify-first reflex is rehearsed monthly rather than hoped for.
Where vishing sits in a training programme
Phone-based attacks should not be a one-off module; they rotate back into the programme as the scam wave changes. Short monthly security awareness training lessons work best: three to ten minutes on the current voice and text scams, with role-specific depth for the people who live on the phone — reception, accounts, help desk and executive assistants. Human risk reporting then shows which roles stay exposed to voice and impersonation lures, so the next lesson lands where the clicks do.
FAQ
What is vishing in simple terms? A scam phone call that pretends to be someone you trust — IT, your bank, your boss — to steal credentials, codes or money. It is phishing by voice.
How is vishing different from phishing and smishing? The channel. Phishing arrives by email, smishing by text, vishing by voice call. The psychology — urgency, authority, trust — is shared; the phone just removes anything technical for a filter to catch.
Can caller ID protect against vishing? No. Caller ID is spoofed routinely, and AI voice cloning means even a familiar-sounding voice proves nothing. Verify through a channel you control instead.
What should staff do if they gave out a one-time code? Treat the related account as compromised immediately: change the password, alert IT, and revoke active sessions. Speed matters more than embarrassment — a no-blame reporting culture gets that call made.
How do you train staff against voice scams? Short recurring lessons on the current pretexts, vishing-style simulation drills where safe, and one firm rule: hang up and call back on a known number. Practice, not policy, builds the reflex.
One last thing
The most valuable phrase in phone security is five words: 'I'll call you back.' Every vishing script depends on keeping you on the line; ending the call costs you nothing and costs the scammer everything.