CyberGlossary

Attacks & Threats

Vishing

Also known as: Voice phishing

Definition

Phishing conducted over voice channels — phone calls or VoIP — to manipulate victims into revealing credentials, payments, or remote access.

Vishing (voice phishing) uses live or automated phone calls, voicemails, and increasingly AI-generated voice clones to impersonate banks, government agencies, IT support, or executives. Attackers often combine vishing with caller-ID spoofing and prior reconnaissance to appear legitimate. Typical goals include extracting MFA codes, persuading the victim to install remote-access software, authorising fraudulent transactions, or convincing IT help-desks to reset passwords. Defences include strict help-desk verification procedures (callback to known numbers, knowledge-based or hardware-token validation), call-screening tools, end-user awareness, and replacing SMS- or phone-based authentication with phishing-resistant factors.

Examples

  • A caller posing as the bank's fraud department asks for a one-time code "to cancel a suspicious transaction".
  • An attacker impersonates a known executive using a cloned voice to instruct accounting to send a wire transfer.

Related terms