What is vishing?
Vishing is phishing by voice: a phone call, a VoIP call or a voicemail in which the attacker poses as someone the victim trusts. The caller might claim to be the bank's fraud team, the company help desk, a government agency, a vendor or a senior executive. A live voice gives the attacker something a written message cannot: the ability to answer objections, sound calm and competent, and raise the pressure the moment the victim hesitates.
How vishing works
Caller ID is not proof of identity. The calling system supplies the number shown, so attackers can display a bank's real number or an internal extension. Frameworks such as STIR/SHAKEN let carriers sign calls to vouch for the originating number, but coverage is incomplete, so a familiar number on the screen proves little. Attackers prepare with public information, such as names, titles and reporting lines from LinkedIn, so they can answer the knowledge questions some help desks still use to verify callers. Voice cloning tools now let a caller sound like a specific executive, which turns a vishing call into a deepfake.
Common vishing scenarios
- The fraud department call: a caller claiming to be the bank asks the victim to read back a code that was just texted, which actually authorizes the attacker's own login or transfer.
- The fake IT support call: the attacker poses as the help desk and talks the user into starting a remote support session.
- The call to the real help desk: the attacker poses as an employee with a lost phone and asks for a password or MFA reset. Widely reported accounts say the 2023 MGM Resorts attack began this way.
- Callback phishing: an email about a fake subscription charge lists a phone number, and the victim calls the attacker.
How to defend against vishing
The core defense is to take the channel away from the caller. Hang up and call back using a number you already trust: the one on the back of the bank card, in the company directory or in the HR system. An attacker can fake an incoming call but cannot answer a call placed to a number on record. Help desks need a written verification procedure for password and MFA resets, such as a callback to the number on file, manager confirmation through a separate channel and no reliance on facts an attacker can look up. Policy should state that nobody, including executives, is exempt, and that technicians who follow the procedure under pressure will be backed up.
Vishing vs. smishing vs. deepfake
Vishing names the voice channel. Smishing names the text message channel. A deepfake is synthetic audio or video that imitates a real person; a call that uses a cloned executive voice is both vishing and a deepfake. Impersonation describes the false identity, which is part of nearly every vishing call. On a question, answer the one being asked about: the method of contact, the technology that made it convincing or the false identity.
Vishing on the CompTIA Security+ exam
Vishing appears under SY0-801 objective 2.5 as a social engineering attack. Scenario clues include a phone call or voicemail, a caller who claims to be IT, a bank or an executive, spoofed caller ID, and a request for a password, a one-time code, remote access or an exception to normal procedure. The best answer for prevention is usually callback verification to a known number or a stronger help desk identity procedure. Distractors include smishing, phishing, deepfake and impersonation. The term also appears in A+ Core 2 (220-1202) objective 2.5.