Vishing: Voice Phishing Explained

Vishing, short for voice phishing, is a social engineering attack carried out over the phone. The caller impersonates someone the target trusts, such as their bank, IT help desk or a senior manager, to obtain passwords, MFA codes, data or a payment. It sits alongside email phishing and smishing in our cyber security glossary. It is one of the 13 types of social engineering attacks in our guide.

What is vishing?

Vishing is phishing by voice: live calls, recorded messages or voicemails designed to make the target act before they think. A phone call adds pressure an email cannot. The caller can answer questions, react to hesitation, sound authoritative and keep the target on the line, and there is no link for a filter to scan.

Calls are often prepared with open-source research. Names, job titles, suppliers and internal jargon gathered from social media, company websites and earlier breaches make a pretext sound genuine.

What are common vishing attacks? Scripts and examples

Most vishing attacks follow a handful of scripts, each built around someone the target already trusts:

Several of these target the organisation rather than the individual. A service desk that resets credentials on the strength of a convincing call can hand over an account with all its access. A supplier bank detail change by phone is the voice version of the invoice redirection seen in business email compromise, and attackers can use both channels in the same fraud, with a call “confirming” a spoofed email.

Callback phishing turns the pattern around: an email or text asks the target to ring a number, and the “support agent” who answers does the rest.

Example vishing call: the fake bank fraud team

This illustrative call follows the “safe account” script that UK banks warn about:

Caller: Hello, is that Mrs Ahmed? This is James from the fraud team at your bank. We have stopped a payment of £1,240 to an online retailer. Did you authorise it?

Target: No, I didn’t.

Caller: Don’t worry, we blocked it. But your account details are on a list we have seen, and someone inside the branch may be involved, so please don’t discuss this with staff there. To protect your money we need to move it to a secure holding account today. I’ll stay on the line while you open your banking app.

Every warning sign is there: a familiar number on caller ID, which can be spoofed; a frightening but plausible story; a request for secrecy; time pressure; and the real goal, a transfer to an account the criminal controls. Your bank and the police will never ask you to move money to a “safe account”. End the call and ring 159 or the number on the back of your card.

How does deepfake voice change the risk?

AI voice cloning lets an attacker imitate a specific person, such as a chief executive or finance director, using recordings from interviews, videos or voicemail greetings. Combined with caller ID spoofing, a call can look and sound like a real colleague.

Recognising a voice is no longer proof of identity, so the defence has to be process:

• Call back on a number from your own records, never one the caller gives you.
• Require two people to approve new payees and bank detail changes.
• Use agreed verification questions or code words for high-value requests.
• Give the service desk an identity check that does not rely on facts an attacker can research.

How do you spot a vishing call?

Most vishing calls share a few warning signs:

• Urgency or fear. A deadline, a frozen account or a threat of trouble if you do not act now.
• Requests for secrets. No genuine bank or IT team needs your password or a one-time code read aloud.
• Pressure to stay on the line. Being told not to hang up or not to tell colleagues.
• Unusual payment instructions. New bank details, a “safe account” or gift cards.
• An unexpected MFA prompt. A request to approve a login you did not start.

If in doubt, end the call and ring back on a number you know. For calls claiming to be from your bank, hang up and dial 159, which connects you to the fraud team at participating UK banks. The NCSC explains how to report a scam call. At work, report every suspicious call to IT or security, even when nothing was disclosed. If you lost money, see how to report phishing and fraud in the UK. Our guide on how to spot a phishing email covers the same habits for email.

How do companies test for vishing?

They commission an authorised vishing test, usually as part of social engineering testing. A typical engagement runs in four stages:

1. Authorisation and scope. Senior management signs off the test, the teams in scope (often the service desk, finance and reception) and any limits, such as no calls to personal phones.
2. Pretext design. Realistic scenarios are agreed in advance: a locked-out employee, a supplier changing bank details, an engineer running “maintenance”.
3. Calls. Testers make the calls and log what was asked, what was disclosed and whether verification steps were followed.
4. Reporting. Results are grouped by team and by control, such as “password resets without call-back”, with practical fixes and training points.

Vishing tests are often paired with a phishing simulation to measure the same people across email and phone.

How can Sovereign Secure help?

Sovereign Secure runs social engineering testing, including phishing simulations and, where scoped, voice pretext (vishing) scenarios, as part of its penetration testing services. We are a PCI SSC Qualified Security Assessor company and ISO 27001 certified, and we report results by team, not by name. To scope a vishing test, request a penetration testing quote.