What Is Vishing? Voice Phishing Explained
Vishing is phone-based social engineering that bypasses technical security controls.
How Vishing Works
Vishing attacks succeed through a combination of social authority, urgency, and information asymmetry. Callers impersonate figures with authority — IT support staff, bank fraud departments, IRS agents, law enforcement, executives — and create scenarios that make immediate compliance feel necessary. The victim is told their account has been compromised and they need to verify their credentials to protect it; that they owe back taxes and face immediate arrest if they do not pay; that their company is being audited and they need to provide access for the investigation; or that there is a technical problem requiring remote access to their device.
Caller ID spoofing allows attackers to display any phone number on the recipient's caller ID, including the actual phone numbers of organizations they are impersonating. A vishing call from a number matching the victim's actual bank branch number, combined with information about the victim gathered from OSINT or previous data breaches, produces a highly convincing scenario that is difficult to evaluate correctly under time pressure.
AI Voice Cloning
Emerging vishing attacks use AI-generated voice clones of known individuals. Attackers obtain voice samples from public sources — YouTube videos, podcast appearances, conference presentations, social media — and generate synthetic audio that convincingly mimics the target's voice. Documented attacks have used voice-cloned CEO audio to authorize wire transfers and voice-cloned family member audio to support grandparent scams. As voice synthesis quality improves, audio verification of caller identity becomes increasingly unreliable.
High-Profile Vishing Attacks
The MGM Resorts 2023 breach began with a 10-minute LinkedIn research effort followed by a vishing call to the MGM IT help desk, impersonating an employee. The attacker obtained a credential reset that initiated the attack chain leading to $100M+ in losses. The Twitter 2020 breach involved vishing calls to Twitter employees that convinced them to provide credentials to a fake Twitter VPN portal. The Uber 2022 breach included vishing calls to an employee by an attacker claiming to be IT support.
These cases share a pattern: sophisticated social engineering conducted by phone, targeting the human authentication mechanisms that technical controls cannot fully protect. Help desks, IT support, and executive assistants are consistently the highest-risk targets for vishing because their job function requires providing assistance to callers who claim to need it.
Defending Against Vishing
Help desk authentication procedures are the primary technical defense against vishing. Help desks that verify caller identity through something other than information the caller provides — requiring a callback to a verified number in the HR system, using a knowledge-based authentication question that only the legitimate employee would know, requiring manager approval for credential resets above certain privilege levels — provide structural resistance to social engineering that individual employee judgment cannot reliably provide.
Security awareness training specifically addressing vishing scenarios — not just phishing — helps employees recognize the pressure patterns that vishing attacks use: urgency, authority, request for credentials or access, and requests to bypass normal verification procedures. Employees who recognize these patterns as vishing indicators have a framework for resistance even when individual elements of a call seem plausible.
Related Reading
What is vishing?
Vishing — voice phishing — is a social engineering attack conducted by telephone where attackers impersonate legitimate organizations or individuals to deceive victims into revealing credentials, transferring funds, or granting system access. Unlike email phishing, vishing exploits the interpersonal dynamics of a real-time conversation — social pressure, authority, urgency — in ways more psychologically compelling than text-based attacks. Vishing has become a primary attack vector for high-stakes intrusions because it bypasses the technical controls that email security tools provide.
What's the difference between vishing, phishing, and smishing?
Phishing is the broad category of social engineering attacks using fraudulent messages — typically email — to obtain credentials, deploy malware, or trick victims into actions that benefit the attacker. Smishing is phishing via SMS text messages, often used for credential harvesting and package delivery scams. Vishing is phishing via phone call, exploiting real-time conversation dynamics. Vishing is the most psychologically compelling of the three because real-time conversation makes resistance harder and because the absence of written record means victims have nothing to re-read and second-guess.
How are major breaches like MGM and Caesars connected to vishing?
The MGM Resorts breach in September 2023 began with a 10-minute LinkedIn research effort followed by a vishing call to the MGM IT help desk impersonating an employee. The attacker obtained a credential reset that initiated the attack chain leading to $100M+ in losses. The Caesars Entertainment breach the same week followed a similar pattern. The Twitter 2020 breach involved vishing calls convincing employees to provide credentials to a fake VPN portal. The Uber 2022 breach included vishing calls claiming IT support. These cases share a pattern: sophisticated social engineering by phone, targeting help desks where human authentication controls are weakest.
How does AI voice cloning change vishing risk?
Emerging vishing attacks use AI-generated voice clones of known individuals. Attackers obtain voice samples from public sources — YouTube videos, podcasts, conference presentations, social media — and generate synthetic audio that convincingly mimics the target's voice. Documented attacks have used voice-cloned CEO audio to authorize wire transfers and voice-cloned family member audio for grandparent scams. As voice synthesis quality improves, audio verification of caller identity becomes increasingly unreliable. The defensive response requires moving away from voice-based authentication toward structural verification (callback to verified numbers, knowledge-based verification, second-channel confirmation).
What technical controls help defend against vishing?
Help desk authentication procedures are the primary technical defense. Help desks that verify caller identity through something other than information the caller provides — callback to a verified number in the HR system, knowledge-based authentication questions only the legitimate employee would know, manager approval for credential resets above certain privilege levels — provide structural resistance to social engineering. Caller ID can be spoofed; voice can be cloned; information about employees is available through OSINT. Only structural verification procedures that operate independently of caller-provided information are effective against sophisticated vishing.
How effective is security awareness training against vishing?
Security awareness training specifically addressing vishing scenarios — not just generic phishing — helps employees recognize pressure patterns: urgency, authority, requests for credentials or access, requests to bypass normal verification. Employees who recognize these patterns have a framework for resistance. However, training alone is insufficient. Sophisticated vishing attacks that combine OSINT-derived employee information with caller ID spoofing and convincing pretexts will deceive a percentage of well-trained employees. Training is necessary but must be paired with structural authentication controls that don't depend on individual employee judgment under pressure.
What is the most important first step against vishing?
Document and audit your help desk's procedure for caller identity verification before performing credential resets, MFA changes, or access grants. If the procedure relies on information the caller provides (employee ID, manager's name, date of birth), it is vulnerable to vishing because all of that information is obtainable through OSINT. The procedure must include verification independent of caller-provided information: callback to a verified number, in-person verification, manager approval through verified channel, or knowledge-based authentication. This single control change addresses the highest-impact vishing attack pattern.
Real-World Example: MGM Resorts — A 10-Minute LinkedIn Search and a Phone Call
The ALPHV/BlackCat affiliates who breached MGM Resorts in September 2023 reportedly identified an MGM IT employee through LinkedIn, then called MGM's IT help desk impersonating that employee. The social engineering call obtained a credential reset that initiated the attack chain. Total impact exceeded $100 million in losses, including 10 days of operational disruption, ransom-related costs, and remediation expenses. The entire attack began with freely available information and a phone call — the simplest and cheapest attack technique available against a target with substantial technical security investment.
Of help desks will reset an account password based solely on information a caller provides — without additional verification — according to security research. This vulnerability is the root cause of some of the most consequential breaches of recent years.