What Is Vishing?
Vishing is voice phishing—a social engineering attack conducted over the phone. Instead of sending a deceptive email, attackers call employees directly, impersonate trusted figures (IT support, vendors, management, government agencies), and manipulate them into revealing passwords, account information, or system access.
The name combines "voice" and "phishing." Like email phishing, vishing exploits trust and psychological manipulation. But unlike email, where there's a written record and time to think, vishing happens in real time over the phone—making it harder for people to verify identity or pause to check facts.
Vishing is effective because voices convey authority, urgency, and emotion in ways text cannot. A calm, confident attacker who sounds like an IT professional or executive can convince employees to bypass security controls that would normally protect them.
How Vishing Works: The Attack Pattern
Successful vishing attacks follow a predictable but effective pattern:
Phase 1: Research and Social Engineering Setup
Before making the call, attackers research the target organization using public information:
- LinkedIn profiles to find employee names, roles, and relationships
- Company websites and job listings to understand organizational structure
- Public IT vendor relationships, software tools, or cloud providers
- Recent news or announcements that can be used as pretext
- Phone numbers from website contact pages or job postings
This research allows attackers to sound credible and reference real people, vendors, or systems—making the call feel legitimate.
Phase 2: The Call and Authority Building
The attacker calls an employee and immediately establishes authority:
- Impersonation: "I'm calling from IT support" or "I'm the network administrator"
- Urgency: "We need to verify your credentials immediately—there's been a security incident"
- Legitimacy: References real people, systems, or recent events: "Hi, this is John from IT. I just spoke with Sarah in Finance about the ransomware threat we saw yesterday..."
- Confidence: Speaks with authority and doesn't pause for questions
The attacker may use caller ID spoofing to make it appear the call is coming from the company's own IT department or a trusted vendor.
Phase 3: The Request
Once authority is established, the attacker makes the request:
- Password Reset: "We need you to change your password. Tell me your current password so we can verify it in the system."
- Account Verification: "For security purposes, I need to verify your username and password."
- System Access: "We need remote access to your computer to apply a security patch. Can you grant me access?"
- Financial Information: "We need to update your direct deposit information. Can you verify your banking details?"
- Multi-Factor Authentication Codes: "We're sending you an MFA code. Please read it to me so I can verify your account."
Phase 4: Exploitation
Once credentials are obtained, attackers have multiple options:
- Log into the employee's email account and reset passwords for other systems
- Access cloud storage, financial systems, or customer databases
- Install malware or backdoors through remote access sessions
- Perform social engineering with finance for wire transfers
- Steal sensitive information before the breach is discovered
Why Vishing Works on Employees
Vishing is effective because it exploits human psychology, not technical vulnerabilities:
Trust and Authority
People naturally trust voices that sound calm, confident, and authoritative. An attacker who mimics an IT professional or manager can sound more credible than the actual person would. Psychological research shows people comply with authority figures—especially when the request seems legitimate and urgent.
Urgency and Pressure
Attackers create artificial urgency: "We need this done immediately," "This is a security incident," "Your account will be locked if we don't verify now." When under pressure, people make quick decisions without thinking critically.
Cognitive Load
Phone calls are different from emails. There's no time to read carefully, research, or forward to others. The employee must think and respond in real time—which increases cognitive load and reduces the ability to spot deception.
Personalization
When an attacker uses the employee's real name, mentions real colleagues, or references real systems they use daily, the call feels personal and credible. "Hi Sarah, this is John from IT—I just worked with Tom on the server migration..."
Fear of Looking Foolish
Employees often don't want to be the one person who "doesn't know" something or who slows down a legitimate process. If an attacker says "I work with your IT team regularly and this is standard procedure," the employee may comply rather than risk being seen as uncooperative.
Real-World Vishing Examples
Vishing has been used successfully in high-profile breaches:
Tech Company Employee Breach
Attackers called a company's help desk, impersonating an executive from the corporate office. They claimed to be new to the organization and needed remote access to systems. Using social engineering and caller ID spoofing, they convinced help desk staff to grant access before identity was verified. The attackers then used that access to steal customer data.
Finance Department Wire Fraud
Attackers called the finance department impersonating the CEO, claiming to be at a conference and needing an urgent wire transfer to cover a vendor invoice. Using caller ID spoofing and detailed knowledge of the company's vendors, they convinced the finance team to wire $243,000 to an attacker-controlled account. The money was gone before the fraud was discovered.
Cloud Account Takeover
Attackers called IT support claiming to be an employee who forgot their password. Using information gleaned from LinkedIn (employee name, recent job start, manager name), the attackers convinced help desk staff to reset the password. They then accessed the employee's cloud account and used it to pivot into the company's cloud infrastructure.
Credential Harvesting at Scale
Attackers used automated calling systems to call employee phone numbers with a recorded message: "Your account has been compromised. Press 1 to speak with security." When employees pressed 1, they were connected to an attacker who claimed to be from IT and asked for credentials "to verify identity."
Why SMBs Are Prime Targets
Small and medium-sized businesses are particularly vulnerable to vishing for several reasons:
Less Formal Processes
Large enterprises often have strict verification procedures for password resets, remote access requests, and account changes. Smaller organizations are more flexible and informal—employees are used to helping each other quickly, which attackers exploit.
Overlapping Roles
In small companies, one person may wear multiple hats: IT support, HR, management, accounting. Attackers can easily impersonate "IT" or "the help desk" because there's less clarity about who that actually is.
Limited IT Staffing
Small businesses often have one IT person or rely on outsourced IT support. Help desk staff may not know every employee personally, making it harder to verify identity through voice recognition.
Higher Trust Culture
Smaller organizations tend to be more trusting and collegial. Employees are more likely to help colleagues quickly without strict verification—which is efficient until attackers exploit it.
Less Security Awareness Training
Large enterprises invest heavily in security training. Many small businesses have limited or no formal security awareness program, leaving employees unprepared for vishing attacks.
Valuable but Accessible Targets
Small businesses often have access to valuable customer data, payment systems, or intellectual property—but less sophisticated security infrastructure than larger organizations. Attackers get significant payoff with lower effort.
How to Defend Against Vishing
1. Establish a Verification Protocol
Create a clear, written procedure for verifying identity over the phone:
- Never give passwords, MFA codes, or sensitive information to someone who calls you
- If someone calls asking for account information, say: "I'll call you back at the official company number." Then hang up and call the real number yourself.
- Verify caller identity by asking questions only the real person would know (not "What is your name?"—attackers know that)
- Confirm with another team member or manager before granting access
- For sensitive requests, require written confirmation via official email
2. Implement Authentication Controls
Technical controls prevent credentials from being useful even if stolen:
- Multi-Factor Authentication (MFA): Even if attackers get the password, they can't access the account without the second factor
- Passwordless Authentication: Move toward passkeys or Windows Hello, which cannot be given over the phone
- Require Verification for Account Changes: Don't allow password resets or email changes without proof of identity through a trusted secondary channel
- Require Approval for Privileged Access: Any request for remote access, admin privileges, or system changes must be approved by a manager
3. Create a Clear Reporting Process
Make it easy for employees to report suspicious calls:
- Provide a dedicated email address or phone number for reporting security incidents
- Make reporting safe—no blame or punishment for reporting a call you weren't sure about
- Train employees that reporting is the right action, even if the call turned out to be legitimate
- When you receive a report, take action: notify other teams and document the pattern
4. Train Employees on Vishing Tactics
Security awareness training should specifically address vishing:
- Teach the difference between vishing, phishing, and other social engineering attacks
- Show real examples of successful vishing calls (with fake names) so employees recognize patterns
- Teach red flags: unsolicited calls asking for passwords, pressure to act quickly, requests that bypass normal processes
- Practice the right response: pause, verify through another channel, and report
- Remind employees that legitimate IT support will never ask for passwords over the phone
5. Establish Verification for Sensitive Requests
For high-impact requests, require additional verification:
- Password Resets: Require verification through a code sent to the employee's registered email or phone (not through the person calling)
- Remote Access Requests: Require approval from IT leadership via written request, not just a phone call
- Wire Transfers: Never process wire transfers based on a phone call alone. Require written request from the person's official email and verbal confirmation through a known phone number
- Account Changes: Require confirmation through the employee's official email before making changes
6. Limit Information Exposure
Reduce the information attackers can gather for social engineering:
- Review what's on your company website—employee names, phone numbers, organizational structure
- Adjust LinkedIn visibility for employees (limit detailed role descriptions, reporting relationships)
- Don't list personal cell phones on company websites or public directories
- Use a general company line for help desk requests rather than individual extensions
- Train employees not to share their manager's name or company details with strangers
7. Use Caller ID Verification
Implement tools to verify caller identity:
- Use a phone system that shows internal vs. external calls clearly
- Be skeptical of calls that claim to be from internal extensions but come from outside the company
- Implement STIR/SHAKEN or similar caller authentication if your phone system supports it
- Never assume caller ID is accurate—spoofing is easy and common
8. Monitor for Vishing Activity
Track and respond to vishing attempts:
- Keep a log of reported vishing calls (time, what was requested, who called, what they said)
- Look for patterns—if multiple employees report similar calls, a coordinated attack may be underway
- Notify all staff when you detect a vishing campaign: "Several employees reported calls claiming to be from IT asking for passwords. This is a vishing attack. Do not respond."
- If credentials were exposed, change passwords and monitor accounts for unauthorized access
9. Verify Critical Vendor Relationships
Attackers often impersonate vendors or IT providers:
- Maintain an internal list of legitimate vendors, their contact numbers, and primary contacts
- If a "vendor" calls unexpectedly, hang up and call the vendor back at the number on your contract or website
- Set up a verification password with critical vendors (like "When I call, you'll say the code is [X]")—use this to verify the vendor calling you
- Never trust a phone number provided in a call; use independently verified contact information
10. Create a Culture of Verification
The most effective defense is a culture where verification is normal, not exceptional:
- Normalize the response: "That sounds important, but I'll verify that with IT directly" is a smart security practice, not uncooperative
- Make it clear that legitimate IT support expects verification and will not be offended
- Praise employees who report suspicious calls—make them security heroes, not rule-breakers
- Lead by example: when you receive unexpected calls, verify identity before providing information
Key Takeaways
- Vishing (voice phishing) exploits trust over the phone to steal credentials and access
- It's effective because it creates urgency, impersonates authority, and happens in real time
- Attackers use public information (LinkedIn, websites) to sound credible
- Small businesses are prime targets due to less formal processes and smaller IT teams
- The best defense is a clear verification protocol: never give passwords over the phone and always verify through an independent channel
- Multi-factor authentication is critical—even if passwords are stolen, attackers can't access accounts without the second factor
- Security awareness training that specifically addresses vishing prepares employees to recognize and report attacks
- A culture where verification is normal and reporting is safe stops vishing before it causes damage