Vishing is voice phishing: a social engineering attack carried out over a phone call or voice message, in which an attacker manipulates someone into handing over sensitive information, credentials, access, or money. The name is a contraction of "voice" and "phishing." It belongs with the other cyberthreats that rely on persuading a person rather than breaking a system.
Most results for this term describe consumer vishing scams that start with unsolicited calls: the fake bank call that asks for bank details or credit card numbers, the robocall about your Social Security number (often posing as the Social Security Administration), the technical support scam asking for remote access.
Those are real, and the Federal Trade Commission (FTC) tracks them, along with identity theft reports. The sharper story in 2026 is corporate: attackers phoning IT help desks, impersonating employees, and talking their way into systems that no exploit could have reached. For cybersecurity teams, that changes who the target is.
What follows covers how vishing works, why it escalated into an enterprise-grade threat, the forms it takes with real examples, and how to defend an organization against it.
How does vishing work?
Every vishing call has the same three-part shape, and it holds whether the caller is targeting a pensioner or a systems administrator. Together, the three parts make up the social engineering tactics that vishing scripts are built on. Learning the shape is more durable than learning any particular scam, because the scripts change constantly and the structure underneath them doesn’t.
- A pretext. The caller's false identity: your bank, your IT department, a vendor you work with, your CEO. Cybercriminals pick a pretext you already have a relationship with, because an unfamiliar caller has to earn trust the familiar one already holds.
- A trigger. Urgency, fear, or authority. A suspicious transaction that needs stopping now. A ticket that has to close before the end of the day. A senior person who needs something and doesn’t have time to explain. All of them create a sense of urgency so the target acts before checking.
- An ask. The credential, the payment, the MFA approval, the remote access session, personal details, or financial information. The ask always arrives after the pretext and the trigger have done their work, never before.
Three techniques make this cheap and scalable.
- Caller ID spoofing puts a trusted number on the recipient's screen, so the display confirms the lie.
- VoIP lets an attacker place calls at volume from anywhere for almost nothing, and swap numbers between attempts.
- AI voice cloning reproduces a specific person's voice closely enough to survive a live conversation. The FBI has issued a public warning about campaigns using AI-generated voice messages to impersonate known contacts, noting that cloned audio and a genuine call can sound nearly identical and that AI-generated content is now often difficult to identify at all.
Modern vishing also rarely arrives alone. Emails or SMS text messages set up the call so the phone rings as expected, or the call ends with a follow-up text to "confirm" something.
Voice phishing trends in 2026 covers how those combinations run in practice.
Vishing, phishing, and smishing: What's the difference?
Vishing, phishing, and smishing are all phishing attacks. Only the channel changes. Phishing on its own usually means email. Vishing is voice phishing, by phone call or voicemail. Smishing combines "SMS" and "phishing" and arrives as a text message.
The labels matter less than they used to, because one campaign often uses all three. A text primes the target, a call makes the ask, and an email carries the link. An employee trained only to spot phishing emails is unprepared for two of those steps.
Why vishing is now an enterprise threat, not a consumer scam
Voice phishing has moved from robocalls aimed at individuals to a main route into corporate networks, and a common first step in a cyberattack.
Google’s Threat Intelligence Group tracks a financially motivated cluster it calls UNC6040, which specializes in voice phishing against organizations. Its operators call employees posing as IT support.
Mandiant describes repeated data breaches this way. The caller talks the target into granting access or authorizing a malicious connected application, then exfiltrates large volumes of data for later extortion. The attackers use no malware and exploit no vulnerability. They make a phone call, usually to an English-speaking employee at a large multinational.
Mandiant's hardening guidance points to the help desk as the weak spot. A help desk's metrics reward resolution time, and it holds exactly the keys attackers want for unauthorized access: password resets and MFA re-enrollment.
An agent who refuses a plausible, urgent request is working against every incentive of the job. The reflexes your help desk agents need to practise covers what changes that.
Common types of vishing attacks
Vishing attacks vary in script, but most fall into four types. Each one exploits a different instinct, from the urge to help a colleague to the fear of losing an account.
1. Help desk and IT impersonation
An attacker calls the help desk posing as an employee locked out of an account, or calls an employee posing as IT and asks for login credentials to close a ticket. Both directions work, and the first is behind the enterprise campaigns of the last two years. It works because people want to help a colleague under pressure, and verifying properly takes longer than not verifying.
2. Executive and vendor impersonation
A cloned voice of a CEO, CFO, or known supplier calls with an urgent payment instruction or approval request. A conference talk, podcast appearance, or earnings call gives the attacker enough audio to work with. This one runs on authority, and the fix is verifying through a channel you already hold, whoever appears to be asking.
3. Account-problem and callback scams
In one version, the caller, posing as your bank or one of the credit card companies, reports suspicious activity on your account. In another, an email or voicemail plants a fake support number for the victim to call back, and that number can look like the toll-free numbers real companies use.
The callback version is effective because the target starts the call and so trusts it. Both play on fear and the urge to fix a problem immediately.
4. MFA fatigue paired with a call
The attacker triggers repeated MFA push prompts until they become intolerable, then calls posing as IT and offers to help the employee clear them by approving one. The call feels like relief, which is why it lands. It turns multi-factor authentication into the lever, using the gap between a technical control and the person operating it.
How to protect your organization against vishing
Anyone can fake caller ID, and a cloned voice can fool people who know the speaker well. A defense can’t depend on employees spotting a fake voice. The vishing red flags that aren’t about the voice look at the warning signs that show up in the request itself.
What holds up is process and practiced behavior.
Build call verification into process
The single most effective control is a mandatory callback to a known number before any credential reset, MFA re-enrollment, or change to payment details. Known number means one already on file, never one supplied during the call.
Write it with no exception for urgency, because urgency is the attack. A policy that bends under time pressure is a policy an attacker can plan around.
Harden the help desk specifically
Give inbound requests a defined identity-verification protocol that an agent follows rather than judges: something no caller can talk them past, and something a manager will back them for applying. Mandiant's guidance goes further in the highest-risk cases, recommending a live video call to confirm identity before anyone receives access.
Enterprise vishing concentrates here, which earns the help desk a control of its own rather than a line in a general policy.
Train the response with realistic voice simulations
Knowing vishing exists does not change what someone does thirty seconds into a convincing live call. Practice does. Run simulated voice calls against the roles most likely to receive real ones, and coach at the moment someone complies rather than weeks later in a scheduled module. Security awareness training that never leaves email trains for one channel and leaves this one untested.
Layer technical signals
Correlating voice-call activity with authentication events (VoIP and SIP logs against MFA anomalies and unusual reset patterns) gives a SOC something to investigate. Treat it as detection rather than prevention. It tells you a call may have happened; it does not decide what the person on the call did.
Turning vishing awareness into a tested response
Convincing fakes mean employees can’t be expected to spot one. The defense that holds is a verification reflex that fires however good the caller sounds, and the only way to know a team has it is to test it with a realistic call.
Frame’s phishing and deepfake simulations use your organization's real context to run voice scenarios, including a cloned-voice call generated from a single audio sample. Deepfake video simulations cover executive impersonation.
When someone complies, coaching reaches them at that moment. The outcomes feed a Human Risk Score built from many signals, so human risk reduction shows which people and teams would take the call. Completion rates can’t show that.
Frame trains and tests how people respond to a call. It isn’t a phone security control and it doesn’t block anything.
The campaigns Mandiant documents worked because a person believed a voice. The defense is a workforce that verifies before it acts, and a way to prove it will.
Book a demo and run a voice simulation against your own help desk.
