Blog: Security
What is vishing? Voice phishing, explained
By the TelecomsXChange engineering team ยท
Vishing, short for voice phishing, is a scam carried out by phone call. The caller pretends to be someone you trust, such as your bank's fraud team, a government agency, IT support, a relative or your boss, and talks you into handing over money, a one-time code, a password, card details or remote access to your computer. No system is hacked. The caller asks, in a way that makes saying yes feel like the safe thing to do.
Definition
Vishing meaning and definition
The word is a blend of voice and phishing. Phishing is the scam you know from e-mail: a message that looks official and gets you to click, sign in or pay. Vishing does the same thing on a phone call, with a person, a recording or a cloned voice doing the persuading in real time. The US Cybersecurity and Infrastructure Security Agency defines vishing as "the social engineering approach that leverages voice communication".
That is why it works on careful people. There is no strange link to hover over and no spelling mistake to notice. There is a calm, professional voice that already knows your name, a number on the screen that looks right, and a problem that seems to need solving now.
How it works
How a vishing call works
Almost every vishing call follows the same four steps, whatever story it tells.
- The pretext: who they say they are. Your bank's fraud department, the tax agency, the police, Microsoft support, your grandson, the company's CEO. The caller ID often backs the story up, because caller ID can be faked.
- The problem, or the prize. A suspicious payment on your card, an unpaid tax bill, a virus on your computer, an accident and bail money, a refund you are owed.
- The pressure. It has to happen now, or your savings disappear, you are arrested, the deal falls through. Often: do not tell anyone, and stay on the line.
- The ask. The one step that turns the call into money. Read out the code we just sent you. Move your savings to a safe account. Buy gift cards and read me the numbers. Install this app so we can help. Confirm your card number and the three digits on the back.
Two newer habits make it harder to spot. Text first, call second: a text message warns that the fraud team will call you shortly, then the call arrives, and the text makes it believable. And voice cloning: a short recording of someone, taken from a video posted online, can be enough to fake their voice on a call, which makes "Mom, I'm in trouble" or "it's the CEO, I need this paid today" sound real.
The common kinds
The vishing calls you are most likely to get
- Your bank's fraud team
- "We blocked a suspicious payment. To cancel it, read me the code we just sent," or "your account is compromised, move your money to this safe account."
- Government, tax and police
- An unpaid tax bill, a warrant, a suspended identity number or an immigration problem, settled today by a payment only this caller can take.
- Tech support
- Microsoft, Apple or your internet provider has found a virus. They need remote access to fix it, then a payment, then your banking.
- A family emergency
- A grandchild in jail, a child in hospital, a relative stranded abroad. Voice cloning now makes the voice sound right.
- Delivery, utilities and subscriptions
- A parcel held at customs, power cut off this afternoon, a renewal to refund.
- The boss, a supplier or the IT help desk
- The business versions: an urgent payment for the CEO, a supplier's new bank details, or a call to the help desk to reset someone's password or multi-factor login.
Seven of these scripts, line by line, with the red flag in each.
The scale
Who it targets, and what it costs
Everyone gets these calls. Older people lose the most per call, and businesses lose the most per incident. The figures below are only what victims reported, for 2025 unless noted.
- United States, FBI. Tech support scams drew 47,794 complaints and $2.13 billion in losses; government impersonation, 32,424 complaints and $798 million. People aged 60 and over reported $7.7 billion lost across every kind of internet crime. (IC3 2025 report)
- United States, FTC. Consumers reported losing $15.9 billion to fraud, over $3.5 billion of it to imposters: about $920 million to government impersonators and nearly $1 billion to business impersonators, with bank impersonators the largest group. In 2024, 41% of older adults who lost $10,000 or more to a business or government imposter said the first contact was a phone call. (FTC Data Spotlight)
- Canada. The Canadian Anti-Fraud Centre received over 112,000 fraud reports involving more than $704 million in losses. (CAFC)
- Australia. Scams reported to Scamwatch that began with a phone call cost AUD 72.5 million, with a median loss of AUD 3,800 per victim who lost money. (Targeting Scams 2025)
Red flags
How to spot a vishing call
The story changes from call to call, but the ask stays the same. Any one of these is enough to hang up.
- They want a one-time code. In the FTC's words, "anyone who asks you for your account verification code is a scammer".
- They want your money moved to keep it safe. No bank protects your savings by having you transfer them.
- They want an unusual payment. Gift cards, cryptocurrency, a wire transfer to a stranger, or cash handed to a courier.
- They want into your computer or phone. Remote access, or an app to install.
- They threaten you. Arrest, deportation, a frozen account, a cut-off today.
- They want it kept secret. Do not tell the teller, do not tell your family, do not hang up.
- They already know a few things about you. Your name, your bank, the last digits of your card. That is not proof: those details leak in data breaches and sit on social media.
One rule covers almost all of it
Hang up and call back on a number you found yourself: the one on the back of your card, on your statement, or on the organization's own website. A real problem will still be there when you call back, and a scam will not.
Compared
Vishing, phishing and smishing
| Arrives by | What gives it away | |
|---|---|---|
| Phishing | a link or attachment, a sender that is almost right | |
| Smishing | SMS text message | a short link, a parcel or account "problem" |
| Vishing | phone call | the ask: a code, a transfer, a payment, access |
E-mail has filters and a report button. Most phone lines have nothing listening. Why the phone is the channel nobody monitors.
Protection
How to protect yourself, your team and your customers
For you and your family, a handful of fixed rules stop nearly every vishing call: how to prevent vishing. Already shared something? What to do in the next hour.
For a business, training is a start, but the control belongs on the phone line, where the scam happens. Open Voice Shield is one hop on your phone system: every call in or out is recorded, transcribed and scored for the shape of a scam, with the red flags quoted from what was said. Your team gets an alert, the flagged number's next call is blocked automatically, and the recording and transcript are kept as evidence. In standard mode the verdict lands minutes after the call. Realtime mode, set up on request at a higher cost, scores the call while it is still up. How it works for a small business.
For a phone operator, the same hop protects every subscriber at once, and can be sold as a monthly add-on: scam call protection your subscribers pay for.
Questions
Frequently asked questions
What is vishing?
Vishing, short for voice phishing, is fraud by phone call. The caller pretends to be someone you trust, such as your bank's fraud team, a government agency, IT support or your boss, and talks you into handing over money, a one-time code, a password, card details or remote access to your computer. The US Cybersecurity and Infrastructure Security Agency defines it as the social engineering approach that uses voice communication.
What does vishing stand for?
Voice phishing. Phishing is the scam by e-mail, vishing is the same trick by phone call, and smishing is the version sent by SMS text message. The goal is the same in all three: get you to hand over money, a code, a password or access while believing you are dealing with someone legitimate.
How can you tell a call is vishing?
The ask gives it away. A real bank, agency or company never asks you to read out a one-time code, move money to a safe account, pay with gift cards or crypto, or install software so they can fix something. Add urgency, a threat or a request to keep it secret, and it is almost certainly a scam, whatever the caller ID shows.
Can a vishing call show a real phone number?
Yes. Caller ID can be spoofed, so a scam call can display your bank's real number or a government office. Treat the number on the screen as a claim rather than proof. Hang up and call back on a number you found yourself, such as the one printed on the back of your card.
Is vishing illegal?
Yes. Vishing is fraud, and deceiving someone out of money or personal data is a crime in Canada, the United States, the United Kingdom and Australia. In the United States, faking caller ID with intent to defraud is also illegal under the Truth in Caller ID Act.
What should I do if I think I have been vished?
Hang up, then call your bank or the company involved on a number you trust and tell them exactly what you shared. Speed matters most for card details and bank transfers. Then report it: ReportFraud.ftc.gov in the United States, the Canadian Anti-Fraud Centre in Canada, Report Fraud in the UK or Scamwatch in Australia.