Vishing

Vishing, short for voice phishing, uses phone calls, voicemail or internet calls instead of links. The caller claims to be from a bank's fraud team, a company's technical support, a government office or the police, and uses conversation to obtain one-time codes, card details, remote access or a transfer. A live voice adds pressure that a written message cannot.

How it works

Caller ID can be spoofed, so the call may appear to come from a real number. Attackers often start with partial data from a leak or an earlier phishing attack, which makes them sound informed. Common scripts include "we detected a suspicious transaction, read me the code we just sent", "your computer is infected, install this support tool" and "your account is part of an investigation, move your money to a safe account". Vishing is often combined with other channels: a smishing text asking you to call back, a fake support number promoted through search ads or fake social media accounts, or an AI-generated voice that imitates a known person.

Example

An illustrative case: a customer searches for a fictional airline's support line and clicks an ad leading to exampleair-support[.]com, which lists a phone number run by scammers. The "agent" asks for booking details, then for card details to "process a refund", and finally for the code the bank sends by SMS. The code actually approves a payment to the scammers.

How to spot it

• The caller asks for a one-time code, a PIN or a full password. Genuine banks and support teams do not.
• You are told to move money to a "safe account" or to install remote access software.
• The caller ID matches a real organization, but the call was unexpected.
• The number came from an ad, a search result or a social media reply rather than the official website.
• The caller discourages you from hanging up and calling back.

What brands can do

• State clearly on your website and in your app what your staff will never ask for by phone.
• Publish official support numbers in one place and keep them consistent across channels.
• Monitor for fake support pages, ads and social accounts that list other phone numbers, and have them removed.
• Work with your telecom provider when your own numbers are being spoofed.

Fake support websites and profiles are often the first step of a vishing scam. Phishvoid finds and takes them down through hosts, registrars and platforms; contact the team for details. See also Fake customer support accounts.

Read more: Fake Customer-Support Accounts on Social Media and Chat Apps