Vishing (Voice Phishing)

Layer 8: People Medium risk

How it works

Vishing uses the telephone instead of email. Callers can easily fake the number shown on caller ID, so a call can appear to come from your bank, the Canada Revenue Agency, a software vendor or your own IT provider. The caller sounds professional, uses real names and details, and creates urgency, such as a suspicious transaction, an overdue tax balance or a security incident that needs immediate action.

The goal may be to collect passwords or one-time codes, convince someone to install remote access software, or persuade them to move funds. Vishing is often combined with other attacks: an email sets the scene and a follow-up call makes it feel legitimate. Because a live conversation applies more pressure than an email, even cautious people can be rushed into decisions.

Warning signs

• Callers asking for passwords, MFA codes or remote access
• Pressure to act before you can hang up and check
• Threats of fines, arrest or account closure
• Requests to install software or visit a website during the call
• Caller ID that matches a real organization but an unusual request

How to defend against it

• Never share MFA codes or passwords over the phone
• Hang up and call back using a number you already trust
• Set a known verification process for IT support calls
• Train staff on common vishing scripts
• Restrict who can install remote access tools

If it happens to you

1. End the call and write down what was asked and shared
2. Change any passwords or codes that were disclosed
3. Tell IT if remote access software was installed
4. Contact your bank if financial details were given