• Overview
    • Scam Map
    • Kill Chain
Recents

    Conversations will appear here

Technique

Vishing

Also known as: Voice Phishing, Phone Phishing, Telephone Phishing, TOAD (Telephone-Oriented Attack Delivery), Callback Phishing, Voice Fraud, Phone Scam

DELIVERYMITRE ATT&CK: Spearphishing Voice sub-technique T1566.004

Voice phishing using phone calls to impersonate legitimate entities and extract information or payments.

Common attack flows

How it fits in a scam

This technique shows up duringDELIVERY

Before

  • SEO PoisoningDELIVERY
  • Social Media ReconnaissanceTARGETING
  • Data BrokersTARGETING
  • Data Breach HarvestingTARGETING

After

  • Remote Access ToolPERSISTENCE
  • Credential TheftCOMPROMISE
  • Identity TheftEXPLOITATION
  • Payment Card TheftCOMPROMISE
  • +1 more

Defense

How to defend against this

How to spot it

  • Unsolicited calls claiming urgent account problems or security issues
  • Caller demands immediate payment via gift cards wire transfer or cryptocurrency
  • Threats of arrest legal action or account suspension to create panic
  • Requests for sensitive info (SSN PIN passwords MFA codes) over phone
  • Caller ID shows trusted org but behavior seems off (spoofed numbers)
  • Pressure to stay on line and not verify through official channels
  • Claims from entities that rarely call (IRS FBI SSA)
  • Background noise suggesting call center rather than legitimate office
  • Caller refuses to provide callback number or case reference

Tools you can use

  • Call ScreeningCost low · Effect medium

Steps you can take

  • Official Channel VerificationCost low · Effect high

Seen in the wild

Where we’ve seen it

Campaigns

  • Tech Support ScamPrevalence high · Avg loss $25,000

Commonly targets

  • Parent
  • Corporate Worker

Further reading

  • MITRE ATT&CK

    Spearphishing Voice sub-technique T1566.004

  • CISA

    Social engineering and phishing guidance

  • FTC

    Consumer scam guidance

  • Keepnet Labs

    Vishing definition and statistics

Related techniques

Variants

  • Phishing Email
  • Deepfake Voice Call
  • Tech Support Scam

Same stage

  • Smishing
  • SEO Poisoning
  • Quishing
  • Fake E-commerce Site
  • Pop-up Scareware
  • +13 more

Similar defense

  • Remote Access Tool
  • Social Media Reconnaissance
  • Authority Impersonation
  • Authorized Push Payment Fraud
  • Crypto Wallet Drain
  • +2 more