What Is Vishing? 5 Tips To Recognize Voice Phishing Calls

What is vishing? Vishing is voice phishing: a caller tries to persuade you to reveal information, approve account access, install software, or move money by pretending to be someone trustworthy. The caller ID, voice, and details they know are not reliable proof of identity. Hang up and call back using a number you already know, such as the number on your bank card or in an official app. This guide covers the common call patterns and what to do if you complied.

Apply the answer

1. Hang up when a caller asks for a code or transfer.
2. Dial a known number yourself.
3. Review the relevant account and payment activity.

What is vishing? Understand the call’s sequence

A “fraud department” caller may describe an imaginary charge, say the account is in danger, and ask you to read a code that just arrived. The code may actually authorize the caller’s own sign-in. Another caller may pose as technical support and request remote-control access. The urgent story is designed to keep you on the line and inside their verification process.

Authority and urgency

Banks, government offices, employers, and service desks carry authority. A scammer combines that identity with a deadline or threat. A genuine problem can still be checked through a known contact channel after you end the call. Vishing attackers often rely on social engineering tactics such as impersonation, manufactured urgency, and pressure to bypass normal security procedures. Our guide on how to recognize social engineering attacks explains how these techniques work across phone calls, email, text messages, and workplace communication channels.

A real code with a false explanation

The texted code may come from the actual bank or service because the attacker triggered the login. Its genuineness does not make the caller genuine. Never read it aloud or approve an unexpected prompt.

Why caller ID and voice are weak proof

Caller ID can be spoofed. Public and leaked information can make a script sound tailored, and synthetic or recorded voices can imitate someone familiar. A call-back to the same number supplied by the caller is not independent verification.

Known details can be old

What is vishing? A caller who knows your address or last four card digits may have obtained them from earlier exposure. Treat them as context, not an authentication factor.

A genuine organization will have another route

Use the company’s website, statement, card, or internal directory. If a real issue exists, its team can find the case through its established process. Do not let the caller insist that you stay connected while “verification” happens. One-time authentication codes should only be entered during a sign-in or security action you initiated through the genuine service. Our guide on how to use an authenticator app explains how to set up compatible accounts, generate temporary verification codes, and protect recovery information. Never read a live code to someone who calls unexpectedly.

Read more: What Is Smishing? How Text Message Phishing Works

Watch for payment redirection

Some vishing attacks seek a transfer to a “safe account,” gift cards, crypto, or a new supplier bank account. Moving money to protect it is a classic false premise. Check transactions in the actual bank app and speak to the institution through a known number.

Supplier or executive impersonation

What is vishing? A work caller may claim a manager approved an urgent exception. Follow the normal second-person approval, documented vendor record, and call-back process. A real manager can confirm through established channels.

Family emergencies

Call the relative’s saved number or another trusted contact. Do not rely on a convincing voice alone. Agree on a household verification habit before an urgent call arrives. Scammers may combine public records with previously exposed account information to make fraudulent calls sound convincing. Our guide on what a credential leak is explains how usernames, passwords, and related account information can become exposed. Knowing a few personal details is not reliable proof that a caller represents a legitimate organization.

Read more: What Is Phishing? Meaning, Examples, and a Safe Response

Protect sign-ins from call-based manipulation

Use unique passwords and MFA, and reject sign-in requests you did not initiate. A passkey or security key can resist a fake website, but it cannot prevent a separate payment scam. Review recovery methods because a caller may ask you to change them.

TOTP codes

For supported accounts, generates time-based codes. The code is for your own sign-in at a verified site, not for a phone agent. Save backup codes securely and never dictate them.

Remote access requests

Do not install a tool based on an incoming call. If you already did, disconnect from the support session, follow official device-security guidance, and contact work IT if it is a managed device. Protecting accounts from vishing requires more than refusing suspicious phone calls. Our guide to best account security practices explains how unique passwords, strong authentication, protected recovery methods, and regular account activity reviews can reduce the impact of stolen credentials.

If you shared a secret or sent money

Act on the exact exposure. A revealed password needs replacement and session revocation. A code or approval may mean an active login; inspect successful sessions and recovery settings. A transfer needs urgent bank contact through an independent channel.

Write down the timeline

What is vishing? Record the number displayed, call time, requested action, transaction ID, and account activity. Do not send actual passwords or codes to a report form. This helps the bank or provider investigate.

Report the attempt

Use the financial institution’s fraud channel and, in the United States, the FTC’s ReportFraud.gov for scams. Work users should notify security promptly even if they complied with a request. For supported accounts, a TOTP authenticator app generates temporary verification codes after enrollment. These codes provide an additional layer of protection when a password is exposed, but they can still be stolen through phishing or social engineering. Never dictate a live code to a caller, and store recovery codes securely.

Read more: How to Protect Yourself From Smishing: A Phone-First Safety Routine

A call-back test that actually breaks the scam

The caller says they are from your bank and that a transfer is pending. You end the call, find the number on your card, dial it yourself, and ask whether the transfer exists. Do not use the number the caller gave you, a link in a follow-up text, or a search advertisement whose domain you have not checked. This separates their story from their communication channel.

If the bank confirms the issue

Follow the bank’s process through the independently reached agent or official app. Preserve case and transaction identifiers. You can solve a real problem without disclosing a code to the inbound caller.

If there is no issue

Report the attempted impersonation. Check whether any information was shared during the first call; knowing your name alone may not require an account reset, while a password or code does.

The caller says there is fraud on your card and gives a name, case number, and the last four digits. Those details may be public, stolen, or guessed; they are not enough to authenticate the caller. The request then shifts to moving money to a “safe account” or reading out a code. That shift is the risk. A real fraud case can be verified by ending the call and contacting your bank through a number you already trust.

Caller ID is not authentication: A displayed bank number can be spoofed. Search results can also contain sponsored impersonation pages, so use the number on a physical card or inside the bank’s official app. If you received a suspicious call while already dealing with a real issue, the coincidence does not change this rule.

Keep the call boundary simple: You can say you will call back through the official channel, then hang up. Do not argue with the caller or follow instructions to keep the line open. On some phone systems, wait for the call to disconnect before dialing; a separate device can be useful when uncertain. Never approve a login prompt you did not initiate just because the caller describes it as a security check.

Respond after disclosure: If you gave a code, contact the bank immediately and check recent activity and security settings. If you transferred money, ask for the bank’s fraud or recall process and preserve transaction details. If you only spoke to the person without giving secrets, record the number and report the attempted scam. The actual exposure determines the urgency.

Read more: What Is a Data Breach? Meaning, Examples, and What to Do

The remote-support variation

A fake technician says your computer is infected and instructs you to install a screen-sharing tool. Once connected, they may view files, ask you to sign into banking, or display a fabricated error. End the session, disconnect if necessary, and use the device maker’s or employer’s actual support process.

Managed work computer

Tell IT the tool name, installation time, access granted, and accounts opened during the session. Do not remove everything before they can assess it if policy asks you to preserve evidence.

Personal computer

Follow official security guidance, remove unrecognized remote access, and secure sensitive accounts from another trusted device if compromise is plausible. Change a password only where it may have been observed or reused.

The synthetic-voice complication

A familiar voice can be imitated or a short recording replayed. Verify urgent family or executive money requests through a saved number and second trusted contact. Do not ask the caller to recite easily discoverable biographical details as a sole proof.

Household process

Agree on a call-back routine before a crisis. For example, call the relative’s saved phone and, if unanswered, contact another family member. The goal is a practical independent route, not an elaborate secret that everyone forgets.

Workplace process

Require a documented second approver for payment or administrator changes regardless of the caller’s title. A real executive can accept that control.

Frequently Asked Questions

Can a bank call me about fraud?

It can, but an unexpected caller is not authenticated by that claim. End the call and use the number on your card or official app.

What if the caller knows my account details?

Knowledge of some details does not prove authority. Verify independently and watch for other signs of exposure.

Is vishing the same as smishing?

Both are phishing forms, but vishing uses voice calls and smishing uses texts. Campaigns can combine them.

Does declining a code request fix everything?

It blocks that request, but check real account activity if you received an unexpected code. Change a reused or exposed password if needed.

Final Thoughts

Vishing succeeds when the caller supplies both the urgent problem and the “solution.” End the call, use a known contact route, and protect any account or payment information you already shared.

Next step

For accounts that still rely on TOTP, can hold the codes. Set it up from each real account’s security settings, keep recovery codes safe, and never type a live code into a page reached through a suspicious message.