Caller ID spoofing is standard in vishing. The number on the screen proves nothing.
What is vishing? How voice phishing works and how to stop it
How vishing attacks use spoofed caller IDs, pretexts and cloned voices to extract OTPs, credentials and payments, and the steps that stop them.
By 7 mins readPublished Updated On this page
You answer the phone and a calm voice says: "Hello, this is the fraud department at your bank. We have detected an unusual transaction on your account. Before we proceed, can you confirm your customer ID and the OTP you are about to receive?"
The caller sounds professional, the number looks official and the situation feels urgent, so most people comply. That is why vishing, or voice phishing, is one of the most effective forms of social engineering in use.
Unlike email or text scams, vishing works on a person in real time. Nobody hacks a system. The attacker works on trust, urgency and the habit of doing what an authority asks until the target reads out a code or approves a payment. Fraud reports covering 2023 and 2024 show phone-based scams rising sharply, alongside large data leaks, cheap VoIP spoofing and AI-generated voices.
What vishing is
Vishing (voice phishing) is an attack that uses phone calls or voicemail to talk people out of sensitive information. There is no link to click. The whole attack is a conversation.
Attackers pose as banks, government agencies, IT helpdesks, HR departments or company executives. Public information, breached data and caller ID spoofing make the call look credible and urgent.
Phone scams are decades old. What has changed is the kit:
- VoIP services that hide the caller's real number.
- AI-generated copies of an executive's or a relative's voice.
- Personal details pulled from social networks, breaches and corporate websites.
- Scripts that copy real customer support dialogue.
The difference from smishing and email phishing is the live interaction. The attacker hears hesitation and adjusts.
How vishing attacks work
Most attacks follow the same six steps. Knowing them is how you spot the call early.
1. Reconnaissance. The attacker collects personal or company details from breaches, social media, corporate websites and LinkedIn. This is the reconnaissance phase in MITRE ATT&CK terms: gathering what is needed for a convincing pretext.
2. Caller ID spoofing. VoIP lets the attacker display any number they like: the bank's, a government agency's, or an internal company extension.
3. The pretext. A story that explains the call. Common ones:
- A suspicious transaction on your bank account.
- A payroll discrepancy.
- A tax penalty or an overdue bill.
- An IT outage that needs your password reset.
- An executive who needs an urgent transfer.
The scripts are rehearsed and delivered well.
4. Pressure. Tone, urgency, fear and authority push the target toward compliance, and because the call is live the attacker adjusts to every reaction.
5. The ask. The attacker asks for:
- OTPs or 2FA codes.
- Banking credentials.
- Remote access to a device.
- Approval of a payment.
- Customer or employee data.
6. No time to think. The attacker stays on the line and gives instructions step by step, so the target never pauses to verify. By the time the call ends, the information is gone or the payment is approved.
Common vishing examples
Each variant borrows a different kind of authority.
Bank impersonation. The caller is from the "fraud department", warns of an unauthorized transaction and asks for the OTP, card PIN or login to "secure" the account.
IT helpdesk or tech support. The caller is from internal IT or an outside vendor and asks an employee for VPN credentials, a password reset or to install a remote-access tool.
Executive impersonation (CEO voice fraud). The caller is the CEO, CFO or a department head. With voice cloning the tone and accent match, and the request is for confidential files or an urgent payment.
Government or tax authority. Threats of unpaid taxes, warrants or frozen benefits. Fear does the work.
Insurance and healthcare. The caller is "verifying" policy details or patient records and needs personal or financial data to do it.
Every one follows the same formula: create urgency, establish authority, push for compliance.
Why vishing works so well
Vishing works on instinct, and a voice carries cues that text cannot.
People trust voices more than text. A calm, confident or stern voice reads as legitimate, and the vocal cues shape behavior before the content is weighed.
Authority bias. When the caller is a police officer, a bank manager or a senior executive, people follow instructions.
Voice cloning. Attackers clone a real person's voice from earnings calls, speeches or online video. It is one of the fastest-growing vishing techniques.
Real-time adaptation. A phone call is two-way. If the target doubts, the attacker changes tack.
Caller ID spoofing. People assume a call from an official number is safe, and spoofing that number is trivial.
What vishing costs
Individuals and organizations both pay.
Individuals suffer:
- Money lost to fraudulent transactions.
- Identity theft after sharing personal data.
- Distress from the coercion itself.
- Accounts taken over.
Organizations are the bigger prize. Criminals target the employees with access to money or data.
The result is:
- Credential theft that opens a corporate breach.
- Fraudulent wire transfers, the usual outcome of CEO fraud.
- Compromised MFA or VPN access.
- Exposure of customer or employee data.
- Reputational damage and regulatory penalties.
Reports for 2023 put the share of enterprises that had encountered vishing attempts above 75%, with attackers using LinkedIn and corporate websites to pick out finance, HR and IT staff.
Phishing vs smishing vs vishing
The three share an intent and differ in channel and tactics.
How to prevent vishing attacks
For individuals
- Verify the caller yourself. If the caller says they are from your bank, hang up and call the number on your card.
- Never read out an OTP, PIN or password over the phone. No legitimate institution asks for them.
- Treat urgency as a warning sign.
- Turn on call blocking and spam filtering; phones and carriers both offer it.
- Keep your phone number off public pages where you can.
For organizations
- Put callback procedures in place so finance and HR verify before acting on an urgent request.
- Run vishing simulations so staff practice handling social-engineering calls.
- Use MFA, role-based access and privileged access controls so one tricked employee cannot do much damage.
- Add VoIP security: caller authentication, call analytics and threat intelligence to flag suspicious calls.
- Define an incident response process for phone-based attacks so the security team knows how to escalate.
Treat every unexpected call as unverified until it is proven otherwise.
What to do if you are a victim of vishing
If you fell for a call or suspect an attempt:
- Hang up.
- Work out what you shared.
- Contact your bank, IT team or provider and lock the affected accounts.
- Change the relevant passwords and turn on MFA.
- Write down what happened and report it to the cybercrime authority in your country.
- Watch the accounts for activity you do not recognize.
The sooner you act, the less it costs.
Where to start
Attackers can clone a voice, spoof a number and open the call with your own personal details. Instinct is no longer a defense; verification is. Hang up and call back on a number you trust.
For the accounts behind the call, Sensfrx scores every login and payment from device, network and behavior signals, so a login made with a stolen OTP from the attacker's device on an unfamiliar network scores high and your rules can block it. Start a free trial.
Vishing FAQs