Vishing — voice phishing — is social engineering conducted over the phone. An attacker calls a target, assumes a false identity, and uses the conversation to extract sensitive information, obtain credentials, or persuade the target to take an action that compromises security.

Despite the focus on email-based phishing, vishing remains one of the most effective social engineering techniques. A well-crafted phone call creates pressure, builds rapport, and demands an immediate response in a way that an email cannot.

Why vishing is effective

Several factors make voice-based attacks particularly dangerous:

Real-time interaction. Unlike phishing emails, which the recipient can read, re-read, and think about before responding, a phone call demands an immediate reaction. The target must process the request and decide how to respond in real time, with the attacker actively guiding the conversation.

Emotional manipulation. Tone of voice, pace, and inflection convey urgency, authority, and emotion far more effectively than text. An attacker can sound stressed, authoritative, friendly, or confused — whatever the pretext requires — and adjust their approach based on the target’s responses.

Caller ID spoofing. Attackers can make their call appear to come from any number: the organisation’s own helpdesk, a known supplier, a bank, or a government body. When the caller ID matches a trusted source, the target’s guard drops significantly.

Absence of technical indicators. Email-based phishing can be caught by filters, flagged by security tools, or identified by a suspicious link. A phone call leaves no such artifacts. There is no URL to hover over, no sender address to inspect, and no attachment to scan.

Social norms around phone calls. Most people treat phone calls as inherently more trustworthy than emails. If someone calls and says they are from IT support, the default response is to help — not to demand verification.

Common vishing pretexts

The specific pretext depends on the target and the objective, but several patterns recur consistently.

IT support. “This is the IT helpdesk. We’ve detected unusual activity on your account and need to verify your identity to secure it.” The attacker asks for the target’s username, password, or MFA code. This pretext works because IT support calls are common in many organisations and the request seems reasonable.

Senior management. “This is [name of CEO/CFO]. I’m in a meeting and need you to process an urgent wire transfer. I’ll send the details by email but I need you to act on it now.” This pretext exploits authority and urgency. The target is reluctant to question a senior figure, especially under time pressure.

Suppliers and vendors. “This is accounts at [supplier name]. Our bank details have changed and we need to update the record before the next payment is processed.” This targets finance teams and can result in payments being redirected to attacker-controlled accounts.

Banks and financial institutions. “We’ve detected a suspicious transaction on the company account. I need to verify some details to block it.” The attacker extracts account details, authorisation codes, or convinces the target to approve a fraudulent transaction.

Regulators and auditors. “This is [regulatory body]. We’re conducting a routine review and need access to [system/data].” The authority of a regulator is difficult to challenge, and the target may feel compelled to cooperate immediately.

How vishing assessments are conducted

A professional vishing assessment is a controlled test of an organisation’s resilience to voice-based social engineering. The process is structured and documented.

Target selection

Targets are chosen based on their role and the type of information or access they handle. Common targets include:

  • IT helpdesk staff — who may be asked to reset passwords, disable MFA, or provide system information.
  • Reception and front desk — who may be asked to connect the caller to specific individuals or disclose information about who is in the building.
  • Finance teams — who may be asked to process payments, change bank details, or share financial information.
  • Executive assistants — who often have broad access and handle sensitive requests on behalf of senior management.

Pretext design

The testing team develops pretexts tailored to the organisation based on OSINT and the agreed objectives. Each pretext includes:

  • A cover identity (who the caller claims to be).
  • A scenario (why they are calling).
  • A specific ask (what they want the target to do or disclose).
  • Escalation techniques (how to respond if the target pushes back).

Execution

Calls are made during normal business hours. The tester follows the pretext, adapting in real time based on the target’s responses. Every call is documented with:

  • The date, time, and duration.
  • The pretext used.
  • What was requested.
  • How the target responded.
  • Whether the objective was achieved.
  • Whether the target reported the call.

Metrics

Vishing assessments produce quantitative data that can be tracked over time:

  • Success rate. The percentage of targets who complied with the request.
  • Partial success rate. Targets who disclosed some information but not enough to achieve the objective.
  • Challenge rate. The percentage of targets who questioned the caller’s identity or the legitimacy of the request.
  • Report rate. The percentage of targets who reported the suspicious call through the organisation’s incident reporting process.
  • Verification rate. The percentage of targets who followed established verification procedures (calling back on a known number, checking with a manager, etc.).

Defending against vishing

No single control stops vishing, but a combination of measures significantly reduces the success rate.

Callback verification. For any sensitive request received by phone, staff should end the call and call back on a known, independently verified number. This single procedure defeats the majority of vishing attacks, because the attacker cannot intercept a callback to a legitimate number.

Code words or challenge phrases. Some organisations use pre-agreed code words for verifying identity in sensitive conversations. This is particularly useful for high-risk roles (finance, IT, executive assistants).

Verification procedures for sensitive actions. Password resets, MFA changes, payment processing, and bank detail updates should all require multi-step verification that cannot be completed in a single phone call.

Awareness training. Staff need to understand what vishing looks like, why it works, and what they should do when they receive a suspicious call. Training should include realistic examples and, where possible, simulated vishing exercises.

Reporting mechanisms. Make it easy for staff to report suspicious calls — and ensure that reports are acted upon. A simple, well-publicised reporting channel (a dedicated email address, a button in the intranet, a Slack channel) removes friction and increases report rates.

No blame culture. If staff fear punishment for falling for a vishing test, they will not report real attacks. The goal is to improve resilience, not to catch people out.

Vishing is effective because it exploits trust, authority, and real-time pressure. Testing for it — and building defences against it — is an essential part of any social engineering resilience programme.