What is "Vishing?"

What is "Vishing?"

Voice Cloning Scams Are on the Rise

You're busy with your workday when you get an unexpected call from a familiar voice: it sounds just like your boss. They are asking you for some sensitive information, and something seems off. What do you do? 

According to a global threat report from a leading cybersecurity firm, voice phishing or "vishing" attacks increased by 442 percent last year. In a vishing attack, a scammer is able to mimic the voice of an authorized person in a company or organization and use that fake voice to steal information, money—whatever they can gain access to.^1,2

It's not just a problem in the workplace; the same voice-cloning technology is used to attack private citizens, too. Even the U.S. government is not immune, with vishers posing as senior officials in order to obtain access to sensitive information.^3,4

It's important to remember that vishing scams extend beyond traditional phone calls. You might receive a fake audio or video chat through a messaging app, social media app, or even via text or other audio-based services. And, thanks to so-called "deepfake" technology, which can allow a scammer to take on the face of a familiar or trusted person, video phishing is also possible.⁵

Imposter scams are on the rise overall in the United States. The following chart shows which states are seeing the most fraud reports by population.

Fight the Vishers

Phishing scams have been around for a long time. Many of the standard practices employed to combat malicious emails and texts can also be adapted to apply to vishing attacks. Here's a refresher. 

1. First, confirm you're talking to the right person. A simple thing to do with a visher is to hang up and dial or contact the person directly, independently verifying their contact information.
2. Don't share sensitive data like contact information in a call unless you have independently verified their information (i.e. you are calling them, not them calling you).
3. Look for the telltale signs of vishing:
   1. Overly formal language
   2. Unusual requests (especially for money or information)
   3. Audio or visual inconsistencies (as seen with deepfake technology)
   4. Requests for payment through unusual means  
4. Don't engage with a suspected scammer or act on suspicious requests.
5. If you have already engaged, take steps immediately to secure any related accounts (change passwords, set up fraud alerts, etc).
6. Report vishing and similar scams to the Federal Trade Commission or call a local consumer protection agency.

While there is no need for fear, it is wise to be on your guard and listen to your instincts if you get a strange call. While scammers may get creative and evolve their tactics over time, these general security practices can help you navigate any unfortunate encounters.

<sup>1. Security Magazine, March 5, 2025.
2. CrowdStrike.com, February 27, 2025.
3. FBI, May 15, 2025.
4. Federal Trade Commission, April 8, 2024.
5. National Council on Aging, October 31, 2024.</sup>