Vishing (Voice Phishing)

Every vishing call follows the same three-part shape, and recognizing it is most of the defense. First the caller establishes authority: they are from your bank's fraud team, your software vendor, or the head office. Then they create urgency — an account is compromised, a payment will bounce, an invoice is overdue today. Finally they make one specific request, and it is always a code, a payment, or remote access to a machine.

What makes it work in 2026 is that the supporting details are easy to fake. Caller ID can be set to display any number, including your own bank's, because the phone network was never built to verify it. Attackers research a company on its website and social media first, so they know your manager's name and your supplier's. And synthetic voice tools now make impersonating a specific person's voice practical rather than theoretical.

It works on businesses because it targets people rather than systems. A company can have flawless software security and still lose money because someone in accounts received a convincing call about a changed bank account. Attackers have largely moved to the phone for exactly this reason: the technical defenses that stopped email attacks do not apply to a conversation.

The defense is a rule rather than a product, and it costs nothing. Nobody legitimate ever needs a code you were sent, and nobody legitimate objects to being called back on a number you already have. Give every member of staff explicit permission to hang up and call back on the number from the bank card, the invoice, or the company directory — never the number the caller gives you. That single habit defeats nearly every version of this.