Vishing

Vishers use fraudulent phone numbers, voice altering software, and other social engineering tactics. Calls come through landlines, mobile phones, or voice over IP (VoIP), and as voicemail. VoIP lets attackers create fake numbers, spoof caller ID so the call appears to come from a legitimate company or institution, and automate hundreds of scam calls that are hard to trace.

A vishing call usually follows a pattern. The caller first gathers phone numbers and background information, then prepares to impersonate a coworker, supervisor, executive, service provider, or government representative. On the call, the visher often claims an urgent security problem, payment issue, or request from leadership so the victim acts before verifying. Voice cloning, built with AI from short audio samples, lets attackers sound like someone the victim knows. The target is information such as a PIN, card details, or account passwords, used for identity fraud, unauthorized transactions, or access to corporate or personal accounts.

The Canadian Centre for Cyber Security advises ending a suspicious call and contacting the organization through a publicly listed phone number or official website, not a number the caller gives or the phone's callback option. Workplaces and families can agree on safe words or call-back codes to confirm identity before discussing sensitive matters. Staff training, clear procedures for verifying requests made by phone, and the spam-call filtering built into most smartphones also help, and STIR/SHAKEN lets phone companies determine whether a VoIP call comes from a legitimate source.