What Is Vishing? How Voice Phishing Scams Work and How to Stop Them

Vishing — short for "voice phishing" — is a scam where a criminal calls you on the phone, pretends to be someone trustworthy, and pressures you into handing over money, passwords, or personal information. It works like email phishing, but the lie is told out loud, often by a real person reading a script or, increasingly, by an AI-cloned voice. The FTC reported that people lost $3.5 billion to impersonation scams in 2025 alone, with phone calls among the main channels scammers used to deliver them.

What Is Vishing?

Vishing is a portmanteau of "voice" and "phishing." Instead of a fake email or text message, the attacker calls your phone directly and impersonates a bank, a government agency, tech support, or even a relative. Because the con happens live and in real time, the scammer can improvise, answer questions, create urgency, and push past hesitation in a way a static email never could.

The term isn't new. The FBI issued one of its first public warnings about a rise in voice phishing back in 2008, and voice-over-IP (VoIP) technology made the scam far easier to scale: it let fraudsters mass-dial numbers cheaply, fake any caller ID they wanted, and hide their real location from investigators. A ring that impersonated IRS and immigration officials between 2012 and 2016 reached more than 50,000 people and stole hundreds of millions of dollars before 24 people were sentenced in 2018 — one of the largest vishing operations ever prosecuted in the United States. In 2020, the FCC adopted the STIR/SHAKEN framework requiring phone carriers to authenticate caller ID, precisely because spoofing had become so central to the problem.

How a Vishing Attack Works

Most vishing calls follow a predictable shape, even though the disguise changes:

1. Setup. The scammer picks a believable identity — your bank's fraud department, the IRS, Medicare, Amazon, Microsoft support, or a family member in trouble — often using personal details scraped from social media, data breaches, or a previous phishing email to sound convincing.
2. Contact. They call (or leave a robocall voicemail) using a spoofed number that can display a real agency's name or a local area code so you're more likely to pick up.
3. Pressure. They manufacture urgency: your account has been compromised, a warrant has been issued, a package is stuck, a loved one has been arrested. The goal is to short-circuit careful thinking.
4. The ask. They request a one-time passcode, a password, a Social Security number, or a payment — almost always through a channel that's hard to trace or reverse, like gift cards, wire transfers, payment apps, or cryptocurrency.
5. Extraction or handoff. If you comply, the scammer either uses the information immediately (entering a 2FA code they just talked you into reading aloud, for example) or moves you to a different app or "secure line" to continue the con away from any call-blocking software.

Common Vishing Scripts and Impersonations

According to the FTC, the specific pretext varies, but the money-and-urgency pattern repeats. The most common vishing setups include:

• Government impersonation: Fake IRS, Social Security Administration, or Medicare agents who claim your benefits will be suspended, you owe back taxes, or your Social Security number has been "used in a crime." The FTC's guide to government impersonation scams notes callers often cite a fabricated employee ID number to sound official.
• Bank and card fraud alerts: A caller claims to be from your bank's fraud department and asks you to "verify" your card number, PIN, or a one-time passcode that was just texted to you — effectively asking you to defeat your own two-factor authentication.
• Tech support scams: A caller (or a pop-up that tells you to call a number) claims your computer is infected and asks for remote access or payment to "fix" it.
• Family emergency / grandparent scams: A caller claims to be a relative who's been arrested, hospitalized, or kidnapped and needs money wired immediately — now sometimes reinforced with an AI-cloned voice.
• Prize, lottery and sweepstakes calls: You've "won" something, but must pay taxes, fees, or shipping first.
• Charity and debt-relief pitches: Requests for donations after a disaster, or promises to erase debt or lower your interest rate for an upfront fee.

Vishing vs. Phishing vs. Smishing

Vishing, phishing, and smishing are all branches of the same underlying con — social engineering, the psychological manipulation of a target into acting against their own interest. What changes is only the delivery pipe: email for phishing, text messages for smishing, and a live or recorded phone call for vishing. Criminals frequently chain all three together in a single campaign — a phishing email primes you, a smishing text adds urgency, and a vishing call closes the deal by walking you through "verifying" your account in real time.

AI Voice Cloning Is Making Vishing Harder to Spot

The newest wrinkle is synthetic voice. Modern voice-cloning tools need only a few seconds of someone's real voice — often lifted from a social media video, a podcast, or a voicemail greeting — to generate convincing fake speech. The FTC warns that a panicked call from what sounds exactly like your grandchild or your boss is no longer proof of who's actually speaking, and its guidance is blunt: "don't trust the voice."

The FBI's Internet Crime Complaint Center has documented this at the highest levels of government. In a May 2025 public service announcement, the FBI warned that criminals have used AI-generated voice messages and text messages to impersonate senior U.S. officials since April 2025, aiming to build rapport with the target before pivoting to a different app to extract money, credentials, or sensitive information. The bureau's advice for spotting one of these calls applies just as well to a fake call from a "relative": independently look up a phone number you already trust and call it back yourself, rather than trusting the number that called you or any number the caller gives you.

Who Vishing Scams Target

Anyone with a working phone number is a potential target, but the data shows two groups bear a disproportionate share of the damage. Of the roughly 32,000 government-impersonation complaints the FBI's Internet Crime Complaint Center tracked in a recent year, well over a quarter came from people aged 60 and older, who alone reported more than $400 million in losses — reflecting both deliberate targeting of older adults and their outsized exposure to scripted, authority-driven pressure. Separately, tech-support and government-impersonation complaints combined topped 80,000 reports with losses above $2.9 billion, underscoring how much of this crime category still arrives by phone rather than email. Younger adults aren't exempt either: AI voice cloning and caller ID spoofing have widened the pool of believable targets, since the scam no longer depends on an older victim being less tech-savvy, only on a convincing voice and a believable number.

Real Warning Signs of a Vishing Call

The FTC and FBI both point to the same handful of red flags, no matter who the caller claims to be:

• Urgency and fear. You're told to act "right now" or face arrest, deportation, a frozen account, or a lost benefit.
• Unusual payment demands. Any request to pay by gift card, wire transfer, cryptocurrency, or a payment app is a near-certain scam — legitimate agencies and businesses don't ask for these.
• Requests for a one-time code. No real bank, government agency, or tech company will ever ask you to read a two-factor authentication code or one-time passcode out loud over the phone.
• Caller ID that looks "too right." A number that displays a government agency's real name or your bank's real number proves nothing — caller ID is trivially spoofed.
• A voice you recognize, asking for money. Treat it the same as a stranger's request until you've verified it independently.
• Pressure not to hang up and call back. Scammers often insist you stay on the line while you "verify" things, specifically to stop you from calling the real organization using a number you already trust.

How to Protect Yourself From Vishing

You can't stop scammers from dialing your number, but you can make yourself a hard target:

• Let unknown numbers go to voicemail. Most automated scam operations won't leave a message, and you can call back later if it's legitimate.
• Never trust caller ID. Hang up and independently look up the organization's real phone number — on a bill, a card, or its official website — rather than using any number the caller gave you or the one on your screen.
• Don't press any numbers on a robocall. Pressing "1" to "speak to a representative" or "be removed from the list" often just confirms your number is active and leads to more calls.
• Treat one-time codes like a password. Never read a 2FA or one-time passcode to anyone who calls you, even if they already know your name, address, or account number.
• Agree on a family verification phrase. The FBI specifically recommends settling on a secret word or phrase with close family members in advance, so an AI-cloned "emergency" call can be checked in seconds.
• Use call-blocking and labeling tools. Most carriers offer free robocall-blocking and "Scam Likely" labeling; turn it on.
• Register and report. Listing your number at DoNotCall.gov won't stop criminal scammers, but reporting numbers helps regulators and carriers block patterns faster.

What to Do If You've Already Been Scammed

If you've paid money or shared information on a vishing call, speed matters:

• Paid by card or bank transfer: Call your bank or card issuer immediately to dispute the charge or reverse the transfer.
• Paid by gift card: Contact the retailer or issuer right away and keep the card and receipt; some issuers can freeze unused balances.
• Paid by wire transfer or payment app: Contact the wire service, your bank, or the app's support line to try to cancel or reverse the transaction.
• Shared a Social Security number or other ID details: Go to IdentityTheft.gov to create a recovery plan.
• Shared a password or 2FA code: Change that password immediately, and anywhere else you reused it, then review your account's recent login and security activity.

How to Report a Vishing Call

Reporting doesn't just help you — the numbers and scripts you report feed into carrier call-blocking systems and law-enforcement patterns:

• Lost money or personal information: File a report at ReportFraud.ftc.gov (linked in the key facts above).
• No money lost, but got an unwanted or spoofed call: Report it at DoNotCall.gov.
• Cybercrime, account takeover, or a call tied to an online scam: File a complaint with the FBI's Internet Crime Complaint Center (IC3).
• Impersonated the IRS specifically: Report to the Treasury Inspector General for Tax Administration (TIGTA).
• Impersonated the Social Security Administration: Report to the SSA's Office of the Inspector General.

What to Do Next

Vishing succeeds because it exploits trust in a voice and panic in the moment, not because victims are careless. The single most reliable defense is procedural, not technical: never let the person who called you be the one who tells you how to "verify" anything. Hang up, breathe, and call back using a number you already know is real. If you want to close off the related attack surface, start by moving away from SMS-based codes toward an authenticator app or a passkey for your most important accounts, and talk to older relatives about agreeing on a family verification phrase before they ever get an "emergency" call.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage