Blog: Security
"Hang up and call back" is not an anti-vishing strategy
By the TelecomsXChange engineering team ยท
Every guide to voice phishing ends the same way: hang up, call back on a number you trust, never read out a code. It is good advice. It is also a request that one person, under a deadline, with a confident voice on the line, makes the right call every time. A business does not run its e-mail security that way. It should not run its phone line that way either.
The problem with advice
Advice has no memory, no alarm and no second chance
Three things are missing from "hang up and call back". A record. When the call is over nobody knows exactly what "the bank" said, what was asked for, or whether anything was given. An alarm. If the person did the right thing, nobody else hears about it. If they did not, nobody hears about it either, until the money is gone. A second chance. The same caller tries reception, then accounts, then the branch, an hour apart. Advice protects the desk that remembered it.
Awareness training and vishing simulations improve the odds at each desk, and they are worth running. They do not change the three gaps. Caller-ID reputation apps judge the number, and the scammer's number is often real and new. STIR/SHAKEN authentication, in force in Canada since 2021, says whether the number was forged and, as the Cyber Centre's guidance notes, nothing about the conversation. None of these looks at what was said, and the conversation is where the attack happens.
A control instead
What a control on the phone line looks like
- It reads every call, in and out. Recorded with each party on its own channel, transcribed, scored minutes after hangup for the shape of a scam: who the caller claimed to be, what they asked for, how they pushed. The score names the red flags in the caller's own words.
- It tells someone. An alert to the security contact, a Slack channel or a ticketing webhook when a call scores above the threshold, with the transcript one click away.
- It stops the second attempt. A number scored high is blocked or diverted before its next call rings, for an hour, a week or for good. Most voice scams take more than one call, so this is where the protection lands.
- It keeps the evidence. Recording, transcript, SIP log and a PDF report, shareable by a password-protected link with the bank, the insurer or the police.
- It is measurable. Flagged calls a week, repeat callers stopped, time from hangup to alert, and which desks the scammers target. A security team can report on it, which it cannot do with advice.
This is what Open Voice Shield does, as one hop between a business's phone system and its carrier, or on a carrier's trunk. Phones, numbers and call flows stay as they are. The setup for a business is described here.
Keep the advice
Train the people, instrument the line
None of this replaces the habit. Pin the Cyber Centre's tips up, run the simulations, keep "hang up and call back" as the first reflex. Then put the control underneath it, so the day the reflex fails at one desk, the call is on record, the team is told, and the caller does not get a second desk.
Start free with $5 credit, or read what the calls actually sound like and the full prevention checklist for people, businesses and operators.
Questions
Frequently asked questions
Is awareness training enough to prevent vishing?
It helps and it is not enough. Training raises the odds that a person notices. It does not record the call, alert anyone when a real one arrives, or stop the same caller's next attempt to a different desk. A control on the phone line does those three things regardless of who answered.
What should a business do about vishing beyond training?
Put detection on the line: record and score every call in or out, alert the security contact with the red flags, block or divert the next call from a flagged number automatically, and keep the recording and transcript. Then measure it: flagged calls a week, repeat callers stopped, time from hangup to alert.
Can a business block vishing calls automatically?
The next attempt, yes. Open Voice Shield scores each call minutes after hangup. An automation rule puts a number scored above the business's threshold under control, and its next call is refused or diverted before it rings. The first call is read, not stopped, so the value lands on the second attempt, which most voice scams need.
What does vishing protection cost a small business?
On Open Voice Shield, per analyzed minute at the plan rate plus one fee per call from 1.5 cents, prepaid, with $5 of credit at signup. Route only the lines that matter, reception and finance, or analyze a sample of the rest.