Overview: Voice Phishing (Vishing)

Quick Definition

A Voice Phishing attack is a social engineering scam conducted over the telephone to steal sensitive information. Also known as "vishing," these attacks involve criminals calling victims while impersonating trusted entities such as banks, government agencies, tech support representatives, or other legitimate organizations to trick targets into revealing personal data, passwords, financial information, or authentication codes.

Voice phishing attacks often begin with automated robocalls that prompt victims to call back a fraudulent number, or they may involve live attackers who use sophisticated social engineering techniques to build trust and create urgency. Common tactics include claiming there's suspicious activity on an account, threatening account closure, or offering fake prizes that require verification of personal details.

These attacks can be particularly effective because voice communication feels more personal and trustworthy than email, and attackers often use caller ID spoofing to make calls appear to come from legitimate organizations. Additionally, they may have already gathered some personal information about their targets through previous data breaches, making their impersonation more convincing.

To defend against voice phishing, individuals should verify caller identity through independent channels, never provide sensitive information over unsolicited calls, and be skeptical of urgent requests for personal data or immediate action.