Vishing (Voice Phishing).

What is vishing?

Vishing is voice phishing. An attacker uses a phone call or another voice message to trick a person into giving up information or access. Phishing is a scam that tries to fool people into acting on a false message.

CISA describes vishing as the use of voice communication. It says the technique can be combined with other social engineering that entices a victim to call a certain number and share sensitive information. Social engineering means manipulating people, not systems, to get what the attacker wants.

How does a vishing attack work?

MITRE ATT&CK lists this behavior as Spearphishing Voice, technique T1566.004. MITRE says adversaries manipulate users through phone calls or voice communications to gain access to systems. The caller may pretend to be a trusted source and may create a sense of urgency.

MITRE also says victims might receive a message that tells them to do one of several things:

• Call a phone number.
• Visit a malicious web address.
• Download malware.
• Install a remote access tool.

MITRE adds that voice phishing can be combined with multi-factor authentication (MFA) request generation, to trick users into giving away their credentials.

CISA says social engineers often pose as legitimate people, such as employees or repair personnel. It says that if an attacker cannot gather enough information from one source, they may contact another source in the same organization and rely on what the first one said. CISA also notes that VoIP, which means calls over the internet, easily allows the caller ID to be spoofed. Spoofed means faked.

What does a vishing call look like?

A CISA advisory on one criminal group says its actors posed as company IT or helpdesk staff, using phone calls or SMS to obtain credentials from employees. The same advisory says they also used spearphishing calls to convince help desk staff to reset passwords or transfer MFA tokens.

How can you spot and reduce vishing?

MITRE lists user training as a mitigation. It says to train users to identify social engineering and spearphishing attempts, to verify caller identity and to stay suspicious of unsolicited calls.

CISA gives similar advice. It says that if an unknown person claims to be from a legitimate organization, try to verify their identity directly with the company. It also says not to share information about an organization unless you are sure the person is authorized to have it. CISA also lists enforcing multifactor authentication among its protective steps. Its advisory on that group points to FIDO/WebAuthn or PKI-based MFA, which it calls resistant to phishing.

For defenders, MITRE suggests several detection ideas:

• Monitor call logs on company devices for unusual numbers and compare them with system events.
• Audit VoIP and SIP logs for suspicious outbound calls.
• Monitor voice app logs for unusual calls linked to downloads or remote tool installs.
• Compare MFA push fatigue or unusual consent attempts with call activity.

Is vishing the same as phishing?

No. Vishing is one kind of phishing. The channel is a voice call, not an email or a text message. Both rely on social engineering. See the related terms on phishing and social engineering.

Is vishing the same as spear-phishing?

Not exactly. Spear-phishing is phishing aimed at a chosen target. MITRE files vishing under the name Spearphishing Voice, which is the voice form of that approach.

Why is a phone call hard to trust?

CISA says caller ID can be spoofed over VoIP, so the number on the screen does not prove who is calling. CISA also says this takes advantage of the public trust in phone security.