Blog: Security
How to prevent vishing: what works for people, businesses and phone operators
By the TelecomsXChange engineering team ยท
Preventing vishing takes three layers. A person needs a few fixed rules: never read out a one-time code, hang up and call back on a number you found yourself, and never move money or give remote access because a caller asked. A business adds verification procedures and a control on its phone line. A phone operator can screen the calls themselves, across its whole network.
For you and your family
Eight rules that stop nearly every vishing call
New to the term? What vishing is and how a call works. The rules below do not depend on recognizing the story, because the story changes. They target the ask, which does not.
- Caller ID is a claim, not proof. A scam call can show your bank's real number, because caller ID can be faked.
- Never read out a one-time code. That includes your bank, "IT" and anyone who called you. The FTC says: "anyone who asks you for your account verification code is a scammer".
- Hang up and call back on a number you found yourself. The one on the back of your card, on a statement, or on the organization's own website, never the number the caller gives you. Use a different phone if you can, or wait a few minutes before you dial, because on some landlines the caller can keep the line open. In the UK, 159 connects you to your own bank and cannot be spoofed.
- No bank moves your money to a "safe account". A request to transfer your savings to protect them is the scam, every time.
- No real organization takes gift cards, crypto or cash by courier. That includes the tax agency, the police and the power company.
- Never give remote access to someone who called you. A support call you did not ask for does not need your screen.
- Agree a family code word. Voice cloning can make a caller sound like your child or grandchild. A word only the family knows settles it in one question.
- Slow down. Urgency is the tool that makes the other rules fail. A real problem is still there after a ten-minute pause. A scam needs you to act now.
Two habits help around the edges: let numbers you do not know go to voicemail, and turn on the spam-call filter your phone carrier offers. And pass the rules on to the people most at risk. In 2024, 41% of older adults who lost $10,000 or more to a business or government imposter told the FTC that it started with a phone call.
For a small or medium business
Procedures, people, and a control on the phone line
A business is a better target than a person: more money moves, more people answer the phone, and one tired employee is enough. Prevention here has three parts.
1. Procedures that stop the money
- Before changing a supplier's bank details, call the supplier back on the number you already have on file, never the one in the request.
- Two people approve any payment above a threshold you set, and neither can be talked out of the second approval by a caller.
- The help desk never resets a password or a multi-factor login for someone who called in, until the request is confirmed another way: a call back to the employee's number on file, or their manager's approval.
- Nobody reads out a code, including to someone who says they are from IT.
- A short "we will never ask you to" list, given to staff and to customers.
2. People who know the script
Short, frequent, realistic training works better than a yearly course, and reporting a suspicious call has to be quick and blame-free, or nobody does it. Training still depends on the person who answers, on their worst day, remembering it under pressure. Why "hang up and call back" is good advice and a weak control.
3. A control on the phone line
E-mail has a filter that reads every message. Most business phone lines have nothing that listens to the call. Open Voice Shield adds that check as one hop on the phone system or the SIP trunk you already run:
- every call in or out is recorded, with each side on its own channel, and transcribed;
- the conversation is scored for the shape of a scam: who the caller claimed to be, what they asked for, how they applied pressure, with the red flags quoted from what was said;
- the team gets an alert by e-mail, Slack or webhook, and the flagged number's next call is blocked or diverted automatically;
- the recording, transcript and report are kept, ready for the bank, the insurer or the police.
In standard mode the verdict lands minutes after the call ends. Realtime mode, set up on request at a higher cost, scores the call while it is still up, in time to cut or divert it. Nothing changes on the phones, and it is prepaid, with $5 of credit to start. How it fits a small business.
For a phone operator or carrier
Screening the conversation, not just the number
Operators already fight the number: STIR/SHAKEN attestation, spoofed-number blocking, reputation analytics and "scam likely" labels. They all judge who is calling. None of them hears what is said, so a scam from a clean or freshly assigned number passes with full attestation.
Open Voice Shield adds the conversation layer. It sits on the network as one hop, reads the calls, and turns a scam into a number blocked across the network and a record the operator can hand to law enforcement. The same hop can protect every subscriber at once and be sold as a monthly add-on: scam call protection your subscribers pay for. For the day-to-day uses on your own traffic, see three ways operators use it.
Not enough on its own
What does not prevent vishing by itself
| Measure | What it does | The gap |
|---|---|---|
| Trusting caller ID | shows a name and number | both can be faked |
| "Be careful" warnings | raises awareness | pressure beats care in the moment |
| Call-blocking apps | block known bad numbers | miss fresh and spoofed numbers |
| Training alone | teaches the rules | depends on one person, on one call |
| STIR/SHAKEN | attests the number was authorized | never hears the conversation |
Too late?
If you already shared something
Act in the next hour, and start with what you gave away: call the bank for card or transfer details, change the password for a password or a code, disconnect the computer for remote access. The full checklist, with where to report it in the US, Canada, the UK and Australia.
Questions
Frequently asked questions
How do you prevent vishing?
In three layers. A person follows a few fixed rules: never read out a one-time code, hang up and call back on a number you found yourself, and never move money or give remote access because a caller asked. A business adds verification procedures for payments and password resets, and a control on its phone line that reads every call. A phone operator can screen the conversation across its whole network.
What is the best defence against vishing?
The call-back rule: hang up and call the organization on a number you found yourself, such as the one on the back of your card. It defeats almost every script, because a real problem survives a call-back and a scam does not. For a business, the best defence is that rule written into procedure, plus a control on the phone line that does not depend on anyone remembering it under pressure.
How do businesses prevent vishing attacks on the help desk?
By never resetting a password or a multi-factor login for someone who called in, until the request is confirmed another way: a call back to the employee's number on file, or approval from their manager. Scripts that impersonate an employee in a hurry work because the help desk is built to be helpful. Recording and scoring help-desk calls catches the attempts that get through.
Do call-blocking apps stop vishing?
Only from numbers already known to be bad. Blocking apps and scam likely labels judge the number's reputation, and vishing campaigns rotate numbers and spoof real ones. They are worth having, and they miss the call from a fresh or spoofed number, which is the dangerous one.
Does STIR/SHAKEN prevent vishing?
It helps with one part. STIR/SHAKEN attests whether the calling number was authorized for the caller, which makes spoofing harder on networks that sign calls. It says nothing about what is said on the call, so a scam from a legitimately assigned number passes with full attestation.
Can vishing be stopped automatically?
On a business phone system or a carrier trunk, yes. Open Voice Shield records each call, transcribes it and scores it for the shape of a scam. In standard mode the verdict lands minutes after hangup and the flagged number's next call is blocked automatically; realtime mode, set up on request at a higher cost, scores the call while it is still up.