Vishing in plain English
The word is a blend of “voice” and “phishing.” In classic phishing, the bait arrives by email; in vishing, it comes by phone call or voicemail. Vishing is a form of social engineering: the attack targets people rather than technology.
Imagine a con artist who rings your doorbell and claims to work for the local utility company. He seems friendly, knows your name, and is in a hurry. Vishing works the same way on the phone – except that the caller never stands in front of you and can even fake the number shown on your display.
That is exactly what makes vishing so effective: a phone call leaves little time to think, and spam filters or antivirus software offer no protection here. A coordinated social engineering test shows realistically how vulnerable a company is.
How vishing works
Most vishing attacks follow a similar pattern:
- Research: The attacker gathers names, responsibilities, and internal terms – from the company website, job ads, or social networks. This analysis of publicly available sources is called OSINT.
- Role: The attacker poses as someone people trust: IT support, the company’s bank, a government agency, a supplier, or senior management. With caller ID spoofing – faking the number shown to the person being called – a familiar number may even appear on the display.
- Pressure: An alleged emergency, a tight deadline, or an instruction “from the very top” is meant to keep the victim from asking questions.
- The actual request: The victim is asked to reveal a password, read out a verification code from multi-factor authentication (MFA), approve a login on their smartphone, install remote access software, or authorize a bank transfer.
Attackers often combine the call with an email or text message sent in advance (smishing). Artificial intelligence is increasingly being used as well: it can imitate voices convincingly – for example, the voice of a well-known executive. Publicly available recordings, for example from videos or interviews, are often all it takes.
A practical example
At a mid-sized machinery manufacturer, the phone rings in the accounting department. The display shows the internal number of the IT support team. The caller gives a name and explains: “We’re seeing suspicious logins on your account. I’m sending a confirmation to your phone right now – please read me the code, and we’ll lock the attacker out.”
The employee becomes suspicious: IT support has never asked for a code before. She politely ends the call and calls back using the number listed on the intranet. Nobody there knows anything about the call. She reports the incident, and the IT team warns all employees that same day.
Had she given out the code, the attacker – who had already stolen her password – would have gained access to her email account: an ideal starting point for fake payment instructions.
Why does this matter for businesses?
Vishing bypasses many technical safeguards. Even multi-factor authentication is of little help if someone passes on the code over the phone or approves a login request. Departments with access to money or credentials are prime targets: accounting, executive assistants, HR, and the IT help desk, which can reset passwords.
The consequences range from hijacked accounts and data leaks to payments to fraudsters. A single successful call can also be the prelude to a larger attack on the entire network.
How to protect your organization
- Callback rule: If you receive an unusual request, hang up and call back using a known, official number – never the number the caller gives you.
- Clear principles: Establish and communicate that your IT team will never ask for passwords or MFA codes.
- Two-person approval: Release payments and changes to bank details only after a second approval through a different channel.
- Secure the help desk: Reset passwords and MFA only after reliable identity verification.
- Phishing-resistant MFA: Methods such as FIDO2 security keys or passkeys don’t involve a code that has to be typed in – so there’s nothing that could be passed on over the phone.
- Awareness: Train your team regularly with realistic examples, and foster a culture in which asking questions and reporting incidents is explicitly encouraged.
How Rootsektor can help
A controlled test shows how well prepared your team is for manipulative calls. As part of Social Engineering & Physical Testing, we carry out coordinated vishing scenarios – realistic, but without exposing individual employees. On request, the results feed into targeted training, for example through Security Awareness & Phishing Simulation. Feel free to reach out via our Contact page.