Article Read Time
Vishing scams, you say? You probably already warned your team about suspicious emails and sketchy links. But for many organizations, the most dangerous scam may now arrive the old-fashioned way: a phone call.
Vishing scams (short for voice phishing) is when attackers use phone calls or voice messages to trick people into sharing sensitive information, granting access, or moving money. Instead of a fake email, you get a convincing voice claiming to be IT support, your bank, a vendor, or even your own CEO.
Thanks to cheap AI tools, these calls are more polished, more personal, and much harder to spot than the “car warranty” spam we’re used to ignoring.
What exactly is vishing?
Vishing scams are a form of social engineering that uses voice calls instead of text messages. The goal is the same as any phishing attack: get someone to:
- Reveal credentials or one-time codes
- Share sensitive data (customer records, payroll info, internal procedures)
- Approve a financial transaction or change payment details
- Grant access (VPN, remote access tools, password reset, etc.)
Attackers lean on human psychology, not hacking skills: urgency, fear, authority, and helpfulness. A calm “IT technician” saying, “We’re seeing suspicious login attempts from your account. Can you confirm your code?” can be far more convincing than a poorly written email.
Why vishing scams should be on your risk radar
Vishing isn’t a fringe threat anymore, it’s exploding:
- Recent analyses found that vishing scams jumped more than 400% year-over-year, driven primarily by AI tools that make these calls cheaper and more convincing.
- Deepfakes and AI-powered scams are now costing organizations worldwide billions of dollars, with some industries reporting seven-figure losses from AI voice scams alone.
At the same time, organizations have gotten better at filtering email and spotting phishing links. So attackers are moving to the one channel that still feels trustworthy: a human voice on the phone. Staff may be suspicious of an email, but a caller who sounds like their supervisor, bank, or major vendor? That still feels legitimate.
For smaller organizations and local governments, this is especially dangerous. You may not have a full-time security team, but you do have staff with authority to move money, share data, or approve changes. That makes you a prime vishing target.
The latest tricks scammers are using.
Modern vishing isn’t just a robocall with a bad script. Attackers are layering in AI, breach data, and multi-channel tactics. Here’s what’s changed:
1. AI voice cloning and deepfake audio
Attackers can now clone a person’s voice using just a short audio clip pulled from social media, a YouTube video, a podcast appearance, or even a voicemail greeting.
That cloned voice can then “call” your staff pretending to be:
- A CEO authorizing an urgent wire transfer
- A finance director asking to “override normal procedures just this once.”
- A vendor rep is asking for updated payment details
The voice sounds right. The caller ID may even be spoofed to match your office or vendor. The only defense is process, not gut instinct.
2. Virtual kidnapping and high-pressure extortion calls
Law enforcement has seen a rise in “virtual kidnapping” scams where an AI-generated voice imitates a loved one, screaming or crying, while someone else demands immediate payment.
These same tactics can be repurposed against executives and staff: imagine a frantic “call” from your CEO claiming they’re in legal trouble and need you to buy gift cards or move funds quickly. The emotional pressure is the point—attackers want you to act, not think.
3. Multi-channel pretexting
Vishing rarely happens in isolation anymore. A common pattern:
- You receive an email about “suspicious activity” or an “urgent invoice issue.”
- Minutes later, the phone rings. The caller references that email.
- They walk you through “verification” steps that actually hand them access or money.
Because the story is consistent across email and phone, it feels more real. Training that only focuses on email phishing leaves people exposed to this kind of coordinated play.
4. Bypassing voice-based security
Some organizations and financial institutions still use voice recognition for account verification. Deepfake audio can mimic a person’s voice well enough to trick these systems, especially when combined with stolen personal data.
If you rely on “if they sound like the right person, it’s fine,” you’re playing directly into attackers’ hands.
How to protect your organization from vishing scams
You can’t stop attackers from calling, but you can make your organization much more difficult to scam. Focus on people, process, and a few smart technical controls.
1. Set a no-secrets-over-the-phone rule
Create a clear policy that staff:
- Never share passwords, MFA codes, or full payment details over the phone
- Never install software or grant remote access based solely on an unsolicited call
- Never change bank details, payroll info, or payment destinations without an out-of-band verification
If “the bank,” “IT,” or “a vendor” calls asking for this information, the default answer should be: “I’m hanging up and calling back on a trusted number.”
2. Require verification through trusted channels
Build in simple, repeatable checks for high-risk actions:
- For financial changes (new vendor bank details, new wire instructions, large payments): require a second person to approve and an independent verification using a known, trusted number or contact method.
- For IT requests (resetting MFA, granting new access, installing remote tools): require the user to initiate a help desk ticket or call IT back via an internal directory.
The standard should be: If they contact you, you verify them.
3. Train specifically on vishing and deepfake calls
Most awareness programs talk about phishing, but barely touch on the phone. Update your training to include:
- Realistic vishing scenarios your staff might face
- Examples of AI-cloned voice scams and how convincing they can sound
- Simple scripts staff can use to say “no” and escalate safely
Simulation (safe, fake vishing calls) can be especially effective—people remember the moment the “fake IT” call turned out to be a test far more than a slide in a PowerPoint.
4. Limit what attackers can learn about you
The more attackers know about your people, the more convincing their calls become. Reduce over-sharing:
- Avoid publishing detailed staff org charts with direct numbers and titles.
- Be cautious about posting recordings of internal meetings publicly.
- Encourage staff to lock down privacy settings on social media, especially for public-facing leaders.
5. Strengthen your technical safety net
Technology won’t solve vishing, but it can help:
- Use call filtering and spam-blocking tools where possible.
- Turn on strong multi-factor authentication that can’t be bypassed by just stealing a code (for example, hardware security keys or app-based prompts that require user interaction).
- Set up alerts and limits for unusual financial activity so a single successful scam doesn’t become a catastrophic loss.
6. Make reporting easy and blame-free
If someone receives a suspicious call, you want to hear about it immediately:
- Provide a simple reporting channel (shared mailbox, hotline, Teams/Slack channel).
- Treat reports as wins, not annoyances. People should feel safe saying, “Something felt off.”
- Capture details (caller ID, script, timing) so you can warn others and adjust defenses.
Vishing is no longer a weird corner case; it’s the next evolution of phishing, supercharged by AI and powered by the one channel people are still trained to trust: a human voice.
If your security program only focuses on email, you’re leaving the phone line wide open.
By updating policies, training your people on vishing scams, and building verification into how your organization does business, you can turn that ringing phone from a weak point back into just what it should be: a helpful tool, not a weapon. If you’d like help designing vishing-resistant processes or staff training tailored to your organization, Commonwealth Sentinel can help you build a program that holds up no matter who’s on the other end of the line.
At Commonwealth Sentinel, we stay focused on cyber security so you can focus on other things. Contact us today or sign up for a free consultation.