What is vishing and how do you stop a voice phishing call?

Vishing is voice phishing: a caller pretends to be your bank, an agency, IT support or a colleague to get money, codes or access. Stop it by hanging up, then calling back on a number from an official source. Never share passwords or one time codes, and never pay with gift cards.

How does a vishing call usually go?

The FCC describes the pattern: scammers create a false sense of urgency and use information found online to sound convincing. They often spoof caller ID so the call appears to come from a trusted number. The FCC's advice for that case is blunt: if you think a call has been spoofed, do not stay on the line, hang up.

Typical scripts include a fraud alert from a bank asking you to "verify" account details, a government agency demanding payment, a technical support agent reporting a virus, and a caller posing as a senior manager who needs an urgent transfer.

What changes in a workplace?

Attackers research targets, which makes workplace vishing sharper. A help desk can be called by someone who knows an employee's name, manager and start date and asks for a password reset or a new multi factor device. A finance clerk can be called by a voice claiming to be an executive. The caller does not need to break any system if a person grants access on the phone.

The FCC also notes that AI generated voice calls are illegal unless the consumer has agreed or the caller is exempt, and voice cloning makes a familiar voice a weaker proof of identity than it used to be. Treat voice as one signal, not as authentication.

Constructed example: the help desk reset

A caller tells the help desk that she is a sales manager on a trip, her phone was stolen and she needs her multi factor device reset to join a client meeting in ten minutes. She knows her employee number and her director's name, both found on a public profile and an old email. The agent, wanting to help, sends a reset link to a personal email address the caller offers.

Within the hour the attacker is in the sales manager's account. The weakness was not technology. It was a procedure that let urgency override verification.

A stronger procedure would require a call back to the number on file, a manager's confirmation through a separate channel, or an in person check, and would never send credentials to a new address.

How do you stop it?

For individuals: do not answer unknown numbers if you can avoid it, hang up if someone asks for money or personal information, and call back using the number on your statement or the organization's website. The FCC says that if a caller pressures you or asks for payment by gift card, it is a scam. Never share account numbers, passwords, PINs or one time codes by phone.

For organizations: write a verification script for help desk and finance staff, and make it easy to follow under pressure. Use phishing resistant authentication such as security keys or passkeys for administrators, since a stolen code is useless against them. Add a code word or call back rule for payment changes. And give people permission to say no without penalty.

What should you do if you were caught?

Hang up and contact your bank or IT team through an official number. Change passwords from a clean device, revoke sessions, and watch accounts. Report the call to the FCC or the FTC, and for losses or business email compromise use the FBI's Internet Crime Complaint Center.

How to check or apply this

1. End the call when anyone asks for a password, PIN, code or payment, whatever the caller ID shows.
2. Call back using a number from an official statement or website.
3. Refuse gift card payments. No legitimate agency or company asks for them.
4. At work, write a verification script for resets and payment changes, with a call back step.
5. Use security keys or passkeys for privileged accounts.
6. Run drills in which a staff member tries to socially engineer the help desk, then discuss the result without blame.
7. Report incidents to your security team quickly so others are warned.

Quick check

Sources

• FCC, Stop Unwanted Robocalls and Texts
• CISA, Recognize and Report Phishing
• FBI Internet Crime Complaint Center

Last reviewed: 18 October 2026.