Guide · Social engineering

How to avoid vishing scams: 10 tips to protect yourself

Voice phishing — vishing — uses a phone call instead of an email to steal money, passwords and one-time codes. Here is how the most common scripts work, the red flags to listen for, and the habits that stop them.

Published October 20, 2026. An earlier defend.network article on this topic lived at this address before the site’s March 2026 relaunch; this guide replaces it, rewritten from scratch with current sources.

The one rule that defeats most vishing: if someone calls you and asks for money, a code, a password or remote access, hang up and call back on a number you look up yourself — from the back of your card, the official website, or your company directory. Never use a number the caller gives you.

What is vishing?

Vishing (voice phishing) is social engineering carried out over the phone. CISA describes it simply: “Vishing is the social engineering approach that leverages voice communication.” Instead of a malicious link in an email, the attacker uses a live call, a recorded robocall or a voicemail to pressure you into handing over money, account details, one-time passcodes or access to your computer.

Vishing works because a voice feels personal and urgent in a way an email does not. A caller can answer your doubts in real time, build a story as they go and keep you on the line so you never pause to check. The FBI’s Internet Crime Complaint Center (IC3) counts these calls in the same category as email and text phishing — its definition of phishing/spoofing explicitly covers “unsolicited email, text messages, and telephone calls purportedly from a legitimate company requesting personal, financial, and/or login credentials.”

How big is the problem?

The FBI’s 2025 IC3 annual report gives a sense of scale. Reported losses across all cybercrime reached about $20.9 billion from just over 1 million complaints. Two phone-driven categories stand out:

  • Call-center fraud. IC3 groups tech/customer support scams and government impersonation scams as call-center fraud. In 2025 these totaled more than 80,000 complaints with losses exceeding $2.9 billion.
  • Older adults. Across all cybercrime types, people aged 60 and over filed 201,266 complaints reporting $7.7 billion in losses — more than any other age group.

The report also notes “distress” or grandparent scams in which voice-cloning technology mimics a loved one; victims reported more than $5 million in losses to these in 2025. That is small next to classic call-center fraud, but IC3 notes the scam is evolving to mimic other family members and close friends in different emergency scenarios.

The vishing scripts you are most likely to hear

1. “This is your bank’s fraud department”

The caller warns of suspicious activity and offers to “protect” your money. The real goal is to get your online-banking login, the one-time code your bank just texted you, or to talk you into moving funds to a “safe account” the scammer controls. A genuine fraud team will never need you to read out a verification code or transfer money to keep it safe.

2. Tech support

You receive a call (or a pop-up telling you to call a number) claiming your computer is infected or your account is compromised. The caller asks you to install remote-access software, then “finds” problems and demands payment — or quietly uses the access to reach your bank accounts. Tech support fraud was one of the largest loss categories in the 2025 IC3 report.

3. Government impersonation

Callers pose as tax, benefits or law-enforcement officials and claim you owe money, face arrest or have a compromised identity number. Threats and deadlines are the tell: a call that threatens arrest unless you pay immediately is a scam — and treat any demand for payment in gift cards or cryptocurrency as a red flag.

4. A loved one in trouble — possibly an AI-cloned voice

A panicked “grandchild” or “son” says they have been arrested or hurt and need money now, often with a second person posing as a lawyer or police officer. The FBI has warned that criminals use AI-generated audio “to impersonate well-known, public figures or personal relations to elicit payments” (IC3 PSA, December 2024).

5. The IT help desk call (workplace vishing)

In business settings, vishing targets the people who control access. CISA and the FBI’s Scattered Spider advisory (AA23-320A) describes attackers who “posed as company IT and/or helpdesk staff using phone calls or SMS messages to obtain credentials,” and who also posed as employees to convince help desk staff to reset passwords. The same group convinced mobile carriers to move victims’ phone numbers to attacker-controlled SIM cards and bombarded staff with MFA prompts until someone pressed “Accept.” Similar help-desk vishing continues to appear in our daily briefings.

6. Impersonated officials and executives

In May and December 2025 the FBI warned of campaigns using text and AI-generated voice messages that claim to come from senior US officials, then move targets to encrypted messaging apps and ask for money, documents or authentication codes (IC3 PSA, December 2025). The same playbook works against companies: a “CEO” voicemail asking finance to make an urgent, confidential payment.

Red flags on any call

  • Urgency or fear. “Act now,” “your account will be frozen,” “a warrant has been issued.”
  • Secrecy. You are told not to hang up, not to tell your family, or not to talk to anyone at the bank branch.
  • Unusual payment methods. Gift cards, cryptocurrency, wire transfers, payment apps or cash collected by a courier.
  • Requests for codes or access. A one-time passcode, a password reset, or installing remote-access software.
  • Caller ID that “proves” it is real. CISA notes that “VoIP easily allows caller identity (ID) to be spoofed” — a familiar name or number on screen proves nothing.

10 ways to protect yourself from vishing

  1. Hang up and call back on a number you trust. This single habit defeats bank, tech-support, government and help-desk scripts. The FBI’s advice is to verify a caller by “hanging up the phone, researching the contact of the bank or organization purporting to call you, and call the phone number directly.”
  2. Never share a one-time code. The FBI warns never to provide a two-factor code to anyone over email, text or messaging apps, and the same applies on a phone call. A code your bank or employer sends you is for you to type, not to read aloud.
  3. Agree on a family code word. The FBI recommends you “create a secret word or phrase with your family to verify their identity.” If a relative calls in distress, ask for it — or hang up and call them on their usual number.
  4. Never pay with gift cards, crypto or wires on request. Payment by gift card, crypto or wire demanded on a call is a classic scam pattern — hang up and verify independently.
  5. Do not install software because a caller asked. Remote-access tools give the caller the same control of your computer that you have.
  6. Treat caller ID as untrustworthy. Spoofed numbers can display your bank’s real number or a local area code.
  7. Slow down. Urgency is the attacker’s main tool. A real problem will still be there after a five-minute call to a verified number.
  8. Limit the voice and personal details you post. The FBI suggests limiting online content of your image or voice and making social accounts private to reduce what can be used to clone you or build a convincing pretext.
  9. Use your carrier’s call-filtering tools and the Do Not Call Registry. Blocking features cut down on robocalls, and the National Do Not Call Registry removes legitimate telemarketers — which makes it easier to recognize that an unexpected sales call is likely a scam, since criminals ignore the list.
  10. Protect your phone number. Ask your mobile carrier about a port-out PIN or account lock, which makes SIM-swap attacks of the kind described in AA23-320A harder.

For organizations: hardening the help desk

  • Verify before you reset. Require help desk staff to confirm identity through an independent channel — a callback to the number on file, a manager confirmation or an in-person check — before resetting passwords or MFA devices. Caller ID and knowledge of an employee ID are not enough.
  • Move to phishing-resistant MFA. CISA’s advisory recommends requiring “phishing-resistant multifactor authentication (MFA) for all services to the extent possible” and notes that FIDO and PKI-based methods are “not susceptible to push bombing or SIM swap attacks.” See CISA’s MFA guidance.
  • Train for voice, not just email. AA23-320A tells organizations to “continue to perform diligent employee training against vishing and spearphishing.” Include finance teams, executive assistants and help desk staff, who are frequent targets.
  • Set payment rules that a phone call cannot override. Any request to change bank details or send an urgent payment should be confirmed by a second person through a known channel.

What to do if you think you were targeted

  1. Stop the conversation. Hang up; do not call back on any number the caller provided.
  2. Call your bank immediately using the number on your card if you shared financial details or sent money. Speed matters for stopping transfers.
  3. Change passwords and secure accounts you discussed, and review sign-in activity. If you installed remote-access software, disconnect from the internet and remove it or get trusted help.
  4. Contact your mobile carrier if your phone suddenly loses service — that can be a sign of a SIM swap.
  5. Report it. In the US, report to the FBI at ic3.gov and to the FTC at ReportFraud.ftc.gov. At work, tell your security team even if you did not fall for it — the same caller is likely trying your colleagues.

Frequently asked questions

What is the difference between vishing, phishing and smishing?

They are the same social-engineering attack delivered through different channels: phishing usually means email, smishing means SMS/text messages, and vishing means voice — phone calls, robocalls and voicemail. Attackers often combine them, for example a text that tells you to call a “fraud line.”

Can scammers really clone a voice?

Yes. The FBI has warned that criminals use AI-generated audio to impersonate public figures and relatives. It advises listening closely to tone and word choice and, above all, verifying through a separate channel or a family code word rather than trusting how a voice sounds.

Is it safe to answer calls from unknown numbers?

Answering is not dangerous by itself; what matters is what you do next. Do not press buttons in response to robocalls, do not confirm personal details, and end the call if anything is requested. Let unknown numbers go to voicemail if you prefer — a legitimate caller will leave a message you can verify.

Related on defend.network

Sources

Facts in this article are attributed to the sources above, each checked on October 20, 2026. If you spot an error, tell us via the About page.