Vishing

Of all types of phishing, vishing is the most difficult to stop with technical tools. There is no link to scan in the voice call and no attachment to sandbox analysis. All that is left is the voice, the pressure and the decision that the victim makes in a few seconds. Today, artificial intelligence pushes the limits of this threat even further, because it allows you to fake the voice of a specific person and conduct a fraudulent conversation in real time.

What is vishing?

Vishing (from voice phishing) is a telephone fraud in which the criminal impersonates a trusted institution or person in order to extort confidential data or persuade the victim to act to his detriment – most often by making a transfer or installing software. The attack is carried out via a voice connection, classic or VoIP.

Vishing belongs to the family of phishing attacks, but it differs from them in its channel and dynamics. Email phishing and smishing (SMS variant) are based on a message that the recipient can read again, check the sender and the link address. Vishing works differently because the manipulation takes place live. The interlocutor does not give time for verification, responds to the victim’s doubts and adjusts the script during the call. It is the lack of a material trace and the pressure of real time that determine the effectiveness of this method.

How does a vishing attack work? Step-by-step diagram

Most vishing campaigns follow a repetitive pattern in which subsequent steps build credibility and emotions:

• Number spoofing. The fraudster impersonates the telephone number of a bank, office or police so that a well-known, official hotline appears on the victim’s display. The fact that the number matches the real one lulls your attention even before the conversation begins.
• Script and building authority. The caller introduces himself as a bank employee, a consultant of the “security department” or an officer. He uses industry terminology and often knows fragments of the victim’s data, for example the name, surname or the last digits of the card number from a previous leak.
• Time pressure and fear. Information appears about an alleged account hack, suspicious transaction or blocked funds. The goal is to throw the victim off balance and make him act without thinking.
• Extortion or taking control. In the end, the victim provides the BLIK code, PIN or SMS authorization code, transfers money to a designated “secure” account or installs a remote desktop application (e.g. AnyDesk), which gives the criminal control over the phone or computer.

Vishing AI – how artificial intelligence is changing voice fraud

Vishing AI is a voice fraud that uses artificial intelligence to clone the voice and automate the conversation, thanks to which the criminal can impersonate a specific person or conduct credible manipulation on a mass scale. Today, to clone a voice just a few seconds of recording, for example from a video on social media or a company webinar.

This layer changes the nature of the threat for two reasons.

• First of all, the signals on which the detection of fraud was previously based disappear: a foreign accent, artificial intonation or linguistic mistakes. The synthetic voice sounds natural, and the systems can answer the victim’s questions in real time.
• Secondly, automation allows you to conduct hundreds of parallel conversations, which previously required the involvement of entire criminal groups.

In organizations, this opens up a new vector of directional attacks. A cloned voice of the president asking for an urgent transfer or an “IT specialist” directing an employee to install software are scenarios that are no longer theoretical.

We broke down the mechanics of such attacks and ways of mitigating the risk during a free series of webinars AI vs Cybersecurity. The series included four meetings devoted to the use of AI on the side of attackers and defenders, and access to recordings and materials is still available.

How to recognize vishing? Warning Signals

Vishing can be recognized by several repeated signals, regardless of how trustworthy the interlocutor sounds:

• A call allegedly from a bank or office, during which the interlocutor asks for a password, PIN, BLIK code or authorization code from an SMS.
• Strong pressure to act immediately, justified by the threat to money or account.
• Prompted to install a “helper” application or to switch to a remote connection to “safeguard your funds”.
• Instruction to transfer money to a new, “technical” or “secure” account.
• The number on the display matches the official hotline, even though the content of the call is questionable – spoofing means that the number itself is not proof of authenticity.

How to protect yourself against vishing?

Vishing protection works on two levels: individual response during a suspicious conversation and organizational procedures and training.

In an individual response, one rule is the most effective: if in doubt, hang up and call back yourself to the number entered manually, for example from the back of the payment card or the bank’s official website. Do not provide passwords, PIN codes or authorization codes over the phone, because a real bank employee will never ask for them. The bank does not ask for a transfer to a “secure” account or to install a remote access application.

At the organizational level, vishing requires more than just one-time training. Clear procedures are needed to verify caller identity, especially for financial orders, and regular employee training in realistic scenarios. This is where controlled simulations come in handy – they show the real vulnerability of the team and allow you to practice safe reactions before a real fraudster calls with the same scenario.

Such exercises are made possible by our proprietary, Polish platform for simulating cyberattacks, supporting, among others, phishing and smishing campaigns, and soon also vishing integrated with AI. The platform operates in the SaaS or on-premise model, and the data does not leave the European Union. If you want to see from the inside what such a simulation and reporting of results looks like, arrange a free demo of the platform.

What to do if you are a victim of vishing?

If you provided login details or authorization codes during the conversation, act immediately.

1. First, change your passwords for banking and related accounts.
2. Then contact your bank to block the card or suspicious transactions.
3. If you have installed the application recommended by the interlocutor, disconnect the device from the network and scan it with an antivirus program, and if in doubt, have it checked by a specialist.

It is worth reporting the incident to limit the consequences and help block the campaign. Suspicious calls and messages can be reported to CERT Polska, and fraud schemes and tips can be found on the government website gov.pl. In case of financial losses, also report the matter to law enforcement authorities.

FAQ – vishing

What is the difference between vishing and phishing and smishing?

Vishing uses voice calls, phishing uses emails, and smishing uses text messages. The difference is not down to the channel. In vishing, the manipulation takes place in real time, so the victim cannot calmly check the sender or link, and the criminal responds to his doubts on an ongoing basis.

Can AI vishing be detected?

It is becoming increasingly difficult to recognize him by the sound of his voice alone, as cloning eliminates accent and artificial intonation. It is more effective to stick to the procedure: identity verification by calling back to a known number and the rule that no urgent request for money or data is confirmed in the same call.

Where to report a vishing attempt in Poland?

You can report suspicious calls and messages to CERT Polska via the form atincident.cert.pl. Descriptions of current fraud schemes are also provided by gov.pl and the Polish Financial Supervision Authority. If there is a financial loss, please notify the police as well.

How to check employees’ resistance to vishing?

The most likely method is a controlled simulation based on a realistic voice scenario, which shows in numbers how many employees provide data or follow the interlocutor’s command. As part of the Practical Anti-Phishing Training, we adapt such exercises to the industry and positions, and the results are included in reports ready for the management board and auditors.