In this article:
Vishing—a word created by combining "voice" with "phishing"—is a form of fraud that uses phone calls and voicemail messages to trick victims into revealing personal information for criminal purposes. Here are some tips on how to recognize and avoid vishing scams.
What Is Vishing?
Vishing is a type of voice-based phishing attack where a scammer calls or leaves voicemails and impersonates someone trustworthy. The goal is to manipulate you into revealing sensitive information, such as your login credentials, credit card number or banking information.
The attacker then uses information they gather to steal money from you or commit fraud, such as taking out a loan or credit card in your name.
Vishing is closely related to smishing, which uses text messages to entice victims into disclosing personal information. But unlike smishing, where you have time to inspect the message, vishing creates a deeper sense of urgency. You may be more likely to fall prey to a live human voice, especially if it's cloned to sound like someone you know.
How Vishing Attacks Happen
Vishing attacks often follow a predictable process. Here's what to look out for.
1. Target Selection
The attacker identifies potential targets and gathers information to help them tailor the scam and impersonate someone the victim knows. They'll either choose victims randomly or use leaked data, social media or public information.
2. Manipulating the Caller ID
Vishing attackers have various tools in their arsenal to make the scam plausible. Caller ID spoofing and smartphone apps can make their calls look like they're coming from someone you trust, while voice over internet protocol (VoIP) services can spoof caller ID and help scammers place hundreds of robocalls within minutes. AI tools also make it easier to clone the voice of someone you trust.
3. Initial Contact
The attacker calls the victim or leaves a voicemail, often claiming to represent a trusted organization. They use urgency to convince you to take action in some way. For instance, they may claim your account has suspicious activity or a lapse in coverage, say you've won money, or inform you that you owe taxes or fines. The criminal often sounds professional and calm, so it can be difficult to tell a vishing call from a legitimate business or telemarketing call.
4. Requesting Sensitive Information or Action
Once the scammer builds trust with a persuasive lie, they'll request information or action from you, claiming it will help. The attacker may ask you to:
- Provide passwords, PINs or one-time passcodes
- Install remote access software
- Transfer money or purchase gift cards
- Approve fraudulent transactions
These steps are required, they say, to confirm your identity, enable a money transfer or cover a missed payment that's putting your service at risk.
5. Exploitation
The attacker uses the information or access to steal money, compromise accounts or commit identity theft.
Then, they move on to the next victim. Some of the information they gleaned from you may help them scam others.
Examples of Vishing
Vishing involves the use of phone services, so you may receive a phone call, voicemail or a robocall. The attacker will paint an urgent scenario to get you to take action and give them personal information. Some common vishing scams include:
- Account issues: The caller claims to represent an organization you do business with, such as your bank, and explains there's a problem with your account. To fix the problem, the caller may ask you to change your existing payment instructions, update your access code or provide your account number.
- Grandparent scam: A caller pretends to be a grandchild or another relative who is in trouble and urgently needs money. The scammer may claim they were arrested or injured and ask you to send money or provide payment information.
- Government impersonation: A scammer claims to work for a government agency, such as the IRS or Social Security Administration, and says you owe money and can face a serious consequence without paying. They may threaten arrest, fines or loss of benefits unless you provide personal information or make an immediate payment.
- Jail scam: A scammer calls the family members of an incarcerated person and says they work for a law enforcement agency. They'll say the incarcerated person is eligible for release if the family member pays thousands of dollars for ankle monitor services.
Vishing vs. Phishing vs. Smishing
Vishing, phishing and smishing are all types of scams that use impersonation and deception to steal sensitive information, money or account access. The main difference is how scammers contact their targets. Vishing uses phone calls or voice messages, phishing commonly uses email and smishing relies on text messages.
Vishing vs. Phishing vs. Smishing
| Vishing | Phishing | Smishing | |
|---|---|---|---|
| What it is | A phishing scam that uses voice communication to deceive victims | A scam where criminals impersonate a trusted person or organization to trick victims | A phishing scam carried out through text messages |
| Communication methods | Phone calls, voicemails or robocalls | Primarily email, but phishing can also encompass other forms of electronic communication | SMS texts and other mobile messaging services |
| Primary goal | Steal sensitive information, money or account access | Steal sensitive information, money or account access, or install malware | Steal sensitive information, money or account access, or get victims to click malicious links |
How to Protect Yourself From Vishing Attacks
You're typically at greatest risk when connected with a live vishing scammer, as these are often professional con artists who are practiced, persistent and persuasive. Here are some tips for avoiding their tricks:
- Be wary if a caller asks for personal information. If a caller asks for account numbers, passwords or other personal information, don't share them. Offer to call back using a number from the organization's website or your account paperwork, not one the caller provides.
- Don't rely on caller ID. Vishing fraudsters can use caller ID spoofing to falsely identify themselves on your phone display. A familiar name or number doesn't necessarily mean the call is legitimate.
- Don't trust a caller based on what they know about you. Scammers may have acquired some of your personal information through data breaches or other fraudulent means and could be trying to get additional information.
- Avoid the conversation altogether. Either hang up if you suspect fraud, or let an unfamiliar call go to voicemail rather than speaking live with a potential scammer.
What to Do if You're a Victim of Vishing Fraud
If you have been victimized by vishing fraud or have reason to believe a call or message originated with a scammer, you can report the matter to local law enforcement, and then take their advice on whether to notify additional state or federal authorities. The following national agencies also have authority to pursue vishing fraud:
- The Federal Trade Commission (FTC) tracks and investigates phone-based fraud through its website and via a toll-free phone number: 877-382-4357 (TTY: 866-653-4261).
- The National Do Not Call Registry follows up on nuisance telemarketing calls and "robocalls."
- The Federal Communications Commission (FCC) investigates cases of caller ID spoofing.
The Bottom Line
Vishing is one of many ways criminals adapt and exploit technology. Understanding how these scams work and how to avoid them can help protect you, your loved ones and your financial well-being.
If you're concerned that vishing scammers have tricked you into disclosing personal information, or if a fraudster reveals they already have some of your personal data, it may be a good idea to monitor your credit history for signs of unauthorized activity.
Experian offers identity theft protection plans that can alert you to activity on your credit reports (and your children's), and notify you if personal information for you or the kids appears online, including on the hidden "dark web" criminals often use to sell stolen data.