Vishing (phone scams): how to spot them

Vishing (voice + phishing) is a phone scam where the caller impersonates a trusted institution: a bank, IT support, a courier or even a government body. A voice inspires more trust than an email, and during a call it is hard to stop and think. It is exactly this real-time pressure that makes vishing dangerous — the victim is pushed to make a decision here and now.

The most common vishing scenarios

• Bank: "We detected a suspicious transaction, verify your identity and read out the code from the SMS."
• IT support: "Your computer is infected, let me connect remotely."
• Manager or colleague: a call asking for an urgent payment (CEO fraud by phone).
• Supplier: "Our account has changed, write down the new details."
• Government body: a threat of a fine or lawsuit if you do not pay immediately.

Signs that a call is fraudulent

• You are rushed and pressured to act immediately, with no time to think.
• You are asked to read out an SMS code, password or card details over the phone.
• You are asked to install a remote-access app or tap a link.
• You are threatened with consequences: account blocking, a fine, a lawsuit.
• The number looks official, but the caller avoids letting you call back yourself.

Golden rule: no bank and no institution will ask by phone for an SMS code, password or card PIN. If they do — it is a scammer.

What to do with a suspicious call

• Do not give in to urgency — you have the right to hang up and verify.
• Do not read out any codes, passwords or card details.
• Hang up and call back on the official number from your card or the institution’s website.
• Do not install any apps and do not allow remote access.
• Report to IT or your manager if it was a work phone or about company matters.

Why vishing is hard to stop with technology

Unlike email, a phone call is not screened by any filter, and the number is easy to spoof so it looks like a bank line on your screen. So the only real protection is a trained person who recognises the pressure tactic and knows the simple rule — hang up and call back yourself.

How to prepare your team

Vishing often works together with phishing and smishing — for example, an email sets the stage and a call "confirms" it. So training should cover the whole scam picture, not just email. Opsinel simulations and short training build exactly the reflex to pause and check, no matter which channel the pressure comes through.