What Is Vishing? Voice Phishing Explained

Your employees have been trained to hover over a link before clicking it. Almost none of them have been trained to hang up on a voice that sounds exactly like their CFO.

That gap is what vishing, short for voice phishing, exploits. Instead of a written email a target might scan and second-guess, a vishing attack puts a live or recorded voice on the phone, impersonating a bank, an IT help desk, or an executive, and uses real-time trust and urgency to extract credentials, payment authorization, or sensitive data before anyone has time to verify. It's effective because it's hard to filter.

Verizon's 2026 DBIR found phone-based phishing simulations produced a 40% higher click rate than email simulations, and IBM's 2026 Cost of a Data Breach Report found voice and SMS phishing led to the costliest breaches of any attack vector, at $5.29 million on average. AI voice cloning is making it worse, not better.

That's the gap vishing lives in. Below, we break down what vishing is, how it works, how it's different from phishing and smishing, and what actually reduces your exposure to it.

What Is Vishing?

Vishing, short for voice phishing, is a social engineering attack where a scammer calls a target by phone and impersonates a trusted person or organization, a bank, an IT help desk, a vendor, an executive, to extract credentials, payment authorization, or sensitive data.

Where phishing relies on a written email and smishing relies on a text message, vishing relies on a live or recorded voice. That single difference changes everything about how the attack behaves and why it's so hard to catch.

How a Vishing Attack Works

Most vishing attacks follow a predictable three-step pattern:

1. Number harvesting and spoofing

Attackers pull phone numbers from data breaches, company directories, or prior phishing emails, then use VoIP tools or caller ID spoofing to make the call appear to come from a trusted source, a bank's real number, an internal extension, or a known vendor.

2. Manufactured trust and urgency

The caller poses as IT support, a bank fraud team, or a senior executive, and creates a reason to act immediately: a locked account, a failed payment, a compliance deadline. Urgency is the mechanism. It's designed to get a decision before the target has time to verify.

3. Extraction

Once trust is established, the attacker asks directly for the credential, MFA code, or wire transfer, or talks the victim through installing remote-access software.

This pattern is also why vishing evades traditional email security so well. There's often no malicious link or attachment to scan, just a phone number and a conversation. Phone numbers aren't tracked as indicators of compromise the way URLs are, so a vishing lure that starts as an email can slip straight past filters built to catch links.

Vishing vs. Phishing vs. Smishing

All three share the same goal: get the target to hand over credentials, data, or money. They differ in channel, and that difference changes how each one is best defended against.

The reason vishing deserves its own category, not just a footnote under phishing, is that channel changes the defense. You can filter a malicious link. You can't filter a human conversation in real time, which is exactly why attackers are leaning into it.

Common Vishing Examples

• IT help desk impersonation. An attacker calls posing as internal IT, references a real employee name or system, and asks the target to "verify" a password or approve an MFA push. This has been the entry point in several high-profile enterprise breaches over the past few years.
  
  

• Executive impersonation / CEO fraud. A caller poses as a senior leader requesting an urgent wire transfer or gift card purchase, often timed to when the real executive is traveling or unreachable.
  
  

• Bank or financial institution impersonation. The caller claims suspicious activity on an account and asks the victim to "confirm" login details or a one-time passcode, information no legitimate bank will ever ask for by phone.
  
  

• Tech support scams. Fraudsters posing as Microsoft, Apple, or a company's own IT vendor claim a device is compromised and talk the victim into granting remote access.
  
  

• AI voice-cloning scams. Attackers use a few seconds of publicly available audio, a earnings call, a conference talk, a LinkedIn video, to clone a real person's voice and use it to authorize a payment or request credentials. The FBI's IC3 recorded more than $5 million in losses from "distress scam" calls using cloned voices in 2025 alone, and logged over 3,100 AI-related elder fraud complaints totaling more than $3.52 billion in losses that year.

Why Vishing Is Getting Harder to Catch

Three things are converging to make vishing more effective than it was even two years ago.

The data backs it up. Verizon's 2026 DBIR found that phone-centric phishing simulations produced a median click rate of about 2%, roughly 40% higher than the 1.4% median for email simulations, and identified pretexting (synchronous voice or chat-based social engineering) as a factor in 6% of breach initial-access cases (Verizon 2026 DBIR). IBM's 2026 Cost of a Data Breach Report found voice and SMS phishing was used in 17% of breaches and led to the highest average breach cost of any single attack vector studied, $5.29 million, ahead of help-desk-style social engineering at $5.23 million and the $4.99 million global average across all attack types.

AI voice cloning removes the last tell. A slightly-off accent or a robotic cadence used to be the giveaway. Cloning tools now need only a few seconds of audio to produce a convincing likeness, and attackers increasingly pull that audio straight from a target's own public appearances.

Legacy training measures the wrong thing. Most security awareness programs are built and scored around simulated phishing emails: annual modules, a phishing test, a completion percentage. That tells you almost nothing about how someone will react to a live, adaptive phone call from someone who sounds exactly like their manager. A once-a-year email module doesn't prepare anyone for a multi-turn conversation designed to build trust and then exploit it in real time.

This is the limit of security awareness training (SAT) as a category. It was built for a single-channel, static threat. Vishing is neither. It's live, adaptive, and it targets the person, not the inbox.

How to Prevent Vishing

For individuals:

• Never share passwords, MFA codes, or account details on a call you didn't initiate, no matter who the caller claims to be.

• Verify independently. Hang up and call the organization back using a number from their official website, not one given to you during the call.

• Treat urgency as a red flag, not a reason to act faster. Legitimate institutions don't threaten immediate account closure or arrest over the phone.

• Be skeptical even when the voice sounds right. Voice-cloning technology has made "it sounded just like them" an unreliable signal on its own.

For organizations:

Employee vigilance is necessary, but it is no longer enough to defend against modern social engineering attacks. Traditional awareness programs provide only a snapshot of past behavior, while attackers continuously adapt across channels. Organizations need an approach that measures real-world risk and reduces it in the moment it matters.

• Traditional phishing simulations and annual training provide only point-in-time insights.

• They reveal who clicked a fake email in the past, not who is vulnerable to today's multi-channel attacks like voice-cloned CFO calls.

• Human Risk Management (HRM) continuously measures how employees behave across email, SMS, and voice instead of relying on periodic tests.

• HRM delivers real-time interventions when risky behavior is detected, rather than post-incident feedback weeks later.

• Cimento runs adaptive, multi-channel attack simulations, including voice and deepfake scenarios.

• It builds a dynamic risk profile for every employee based on how they actually respond under pressure.

• The same risk modeling increasingly extends to AI agents operating on employees' behalf.

• The focus shifts from asking, "Did they complete the training?" to "How likely are they to fall for this attack right now, and what can we do to stop it before it happens?"

How Cimento Can Help

Cimento runs phishing simulations across email, SMS, and voice, enhanced with AI-generated deepfake content, so a vishing test isn't a bolt-on to an email-based program; it's part of the same simulation engine. Scenarios adapt based on role, behavior, and current attack patterns rather than running the same static script for everyone.

• Simulations are tailored to each employee's role and likely attack surface, not a one-size-fits-all phishing exercise.

• High-risk users such as executives, finance approvers, and help desk staff are tested against the specific attack scenarios they are most likely to face, including cloned-voice and executive impersonation attempts.

• The same behavior-based risk model extends to AI agents, treating agent risk as an extension of the employee who configured or oversees them.

This is where simulation and training stop being separate programs. Cimento runs the attack, watches what happens, and turns the outcome into the next lesson automatically, closing the loop between "here's what could happen to you" and "here's what to do differently" in real time. Instead of a once-a-year training calendar, employees get continuous, behavior-triggered coaching that tracks their actual risk profile as it changes, not a fixed curriculum everyone sits through regardless of relevance. Book a Demo.

FAQs About Vishing

1. Is vishing illegal? 

Yes. Vishing typically involves wire fraud, identity theft, and impersonation, all of which are prosecutable under federal and state law in the US. Victims can report incidents to the FBI's Internet Crime Complaint Center (IC3) at ic3.gov.

2. What's the difference between vishing and phishing?

Phishing happens over email; vishing happens over a live or recorded phone call. Vishing tends to be harder to detect with automated tools because there's often no malicious link to scan, just a conversation.

3. Can vishing calls be traced?

Yes, but only some of the time. Attackers commonly use VoIP services and caller ID spoofing specifically to defeat tracing, which is part of why the FTC's Do Not Call Registry and telecom-level protocols like SHAKEN/STIR exist, though neither stops a determined scammer.

4. Who do vishing attackers usually target?

They target new employees, IT help desks, finance teams, and older adults, since they are more likely to trust an unexpected call or be less familiar with current attack patterns. Executives are also a growing target for AI voice-cloning scams specifically because their voices are the most publicly available.

5. Does multi-factor authentication (MFA) stop vishing?

It helps, but it isn't complete protection. Attackers increasingly ask victims to read out or approve an MFA code directly during the call, which defeats MFA entirely. MFA reduces the blast radius of a stolen password; it doesn't prevent someone from being talked into handing over the code itself.