What is vishing? How voice phishing became the front door to the enterprise

Vishing is phishing carried out by phone. An attacker calls a target, impersonates someone the target has reason to trust (the IT help desk, a bank, a colleague) and talks them into handing over credentials, approving a prompt, moving money, or granting access. The name is a contraction of voice phishing, and the two terms mean the same thing.

The technique is old. What changed is that the phone call has become the leading way attackers get into cloud environments, and that the human on the other end no longer has a reliable way to tell who is speaking.

Vishing, phishing, and smishing

The three are the same play run over different channels, and the distinction matters mostly because the defenses differ.

Email phishing runs into a decade of accumulated defenses. A vishing call arrives at a person, and the only control between the attacker and the outcome is that person’s judgment.

That asymmetry is the whole reason attackers moved. Mandiant found voice phishing involved in 11% of all intrusions, ranking it the second vector overall, and in 23% of cloud intrusions, where it ranked first. Email phishing declined over the same period (Mandiant, M-Trends 2026).

Those two figures are both real and they have different denominators. Vishing is involved in about one in nine intrusions overall, and closer to one in four when the target is a cloud environment.

How a vishing attack runs

The attacks that reach enterprises are researched and rehearsed. A rough anatomy:

Reconnaissance is free and public. Professional networking profiles give an attacker the org chart, job titles, reporting lines, and who started recently. Breach corpora supply dates of birth, addresses, employee IDs, and the last four digits of identifiers, precisely the facts that verification scripts still ask for.

Infrastructure is prepared in advance. CISA’s advisory on Scattered Spider lists domains registered to support these calls, appending the target’s own name to a service-desk or single-sign-on term to add credibility, in patterns like targetsname-helpdesk[.]com and targetsname-servicedesk[.]com (CISA, advisory AA23-320A). A caller who tells an employee to “go to the portal and confirm” may be sending them somewhere the attacker built.

The number looks right. Caller ID spoofing is cheap and widely available. Google Threat Intelligence tracked the group UNC6671 targeting financial services organizations using spoofed help desk phone numbers, with $10.69 million in ransoms traced (Google Threat Intelligence, August 2026).

The pretext is ordinary. Rarely an emergency: a password reset, a locked account, a routine security check. These arrive dozens of times a day and staff are measured on resolving them quickly.

The ask escalates. CISA documents the group posing as company IT or help desk staff “to obtain credentials from employees,” posing as IT staff “to convince employees to share their one-time password (OTP), an MFA authentication code,” and posing as help desk staff “to direct employees to run commercial remote access tools enabling initial access” (CISA, advisory AA23-320A). MITRE tracks the technique as Impersonation (T1656).

Or the call runs the other way. The same advisory records the reverse: posing as employees to convince IT or help desk staff to “reset the employee’s password, and transfer the employee’s MFA to a device they control.” Both directions of the same call are attacked, and most organizations have a control for only one.

Voice stopped being evidence

For as long as phones have existed, recognizing a voice counted for something. That assumption is now the weakest part of the system.

McAfee researchers, testing freely available cloning tools, produced a clone with an 85% voice match to the original from three seconds of audio in one test, and reached a 95% match after training the model on a small number of audio files (McAfee Labs, 2023). Three seconds is a voicemail greeting, a conference panel, a webinar recording, a company video.

People know they cannot tell. In the same research, 70% of respondents said they were not confident they could distinguish a cloned voice from the real thing, and one in four reported experiencing a voice-cloning scam or knowing someone who had (McAfee Labs, 2023).

The picture is no better for synthetic video, which now appears in these attacks too. In a 2025 iProov study of 2,000 US and UK consumers, only 0.1% correctly identified every real and fake sample, and high-quality deepfake video was caught 24.5% of the time, even after participants were told to look for fakes (iProov, 2025).

An agent listening for whether a caller sounds like the account holder is evaluating something the attacker now controls. That is not a training problem.

Why the enterprise target is the help desk

Vishing against consumers takes money from an individual. Vishing against an enterprise usually goes through the help desk, because that is where the highest-value action can be triggered by conversation alone.

The help desk sits where high privilege meets high pressure. It can reset passwords and rebind MFA, the two actions that hand over an account, and it is measured on handle time and first-call resolution, which push toward saying yes. It also deals constantly with people who genuinely cannot authenticate, so “I can’t get my code” is not a red flag. It is Tuesday.

CISA’s advisory describes the sequence plainly: attackers first learn what steps are needed to conduct password resets, then call employees and help desks to gather reset-specific information about a target, then make calls to convince help desk personnel to reset passwords or transfer MFA tokens. At that point, the advisory notes, they perform account takeovers against users in single-sign-on environments (CISA, advisory AA23-320A).

The advisory also notes these groups target contracted IT help desks and abuse those trusted relationships, which widens the surface beyond your own staff.

What it costs

The FBI’s Internet Crime Complaint Center recorded $20.877 billion in reported losses across 1,008,597 complaints in 2025, up 26% year over year (FBI IC3, 2025 Annual Report, p6). Business email compromise accounted for 24,768 complaints and $3.05 billion, averaging roughly $123,000 per incident, with 86% of losses moving by wire or ACH (FBI IC3, 2025, pp7–10).

Where a vishing call is the entry point to a full intrusion, the figures are larger and on the public record. MGM Resorts disclosed roughly $100 million in impact for the quarter following its 2023 incident (MGM Resorts, Form 8-K, October 2023). Caesars reported a payment of approximately $15 million (Caesars Entertainment, Form 8-K, September 2023). Marks & Spencer put its 2025 incident at around £300 million in operating profit (M&S trading statements, 2025). Transport for London’s cost about £29 million, and two people were sentenced to five and a half years at Woolwich Crown Court in July 2026 (CPS).

Why the usual answers do not close it

Awareness training asks staff to detect something specialists struggle with. The iProov and McAfee figures describe the ceiling on human detection, and it is low. Training also collides with the service level agreement: an agent told to be suspicious is also told to resolve calls quickly.

Caller ID is spoofable and is being spoofed, as the UNC6671 tracking shows.

Callback to the number on file is better advice, and it fails against a SIM swap. CISA lists SIM swap attacks among these groups’ core techniques. A number that moved to a new SIM this morning still matches your directory.

Knowledge questions ask for facts that are in breach corpora or on public profiles. This is a property of the method rather than of any product, and every platform that offers them inherits it.

MFA verifies a credential, and these attacks leave the credential alone. They ask a person to reset it, or ask the user to read the code aloud.

What each of these shares is that they either test something the attacker can supply, or ask a human to make an expert judgment under time pressure.

What actually closes it

The control that holds is verification against a source the caller does not control, performed before the request is granted rather than after.

In practice that means checking a government-issued ID against the authority that issued it. In the United States that is the state DMV, queried over the AAMVA network. The question shifts from “does this document look real,” which generative models are good at, to “does the issuing authority hold a matching record,” which the attacker cannot influence.

Two signals belong in the same check, and both come from outside your directory:

SIM swap and port-out detection. The mobile network operator knows when a number changed hands. A number that moved hours before a reset request tells the agent more than anything else available on that call.

Man-in-the-middle and anti-replay detection. These confirm the session is live and direct rather than relayed from elsewhere or replayed from an earlier capture. Trusona’s implementation is patented (US Pat. 10,601,859).

Three things make the difference between a control and a policy:

It has to work for someone who enrolled nothing, because the caller’s whole premise is that they cannot use what they enrolled.

It has to return a result the agent can read. A red, yellow, or green outcome lets them act without becoming an expert in synthetic media.

It has to be hard to talk past. Every verification step has an exception path, and if agents can be argued through it under pressure, the control covers only the calls nobody pushed on. Measure the override rate; that number is your real coverage.

For the specific case where a vishing call is combined with a real-time phishing kit, so that the attacker relays a live session and your logs show a clean login, the mechanics are worth reading in full: vishing and real-time phishing kits.

ATO Protect verifies the person on the call against the authority that issued their ID, in real time, with no pre-registration, no app download, and no selfie or liveness check, because generative AI defeats those. Agents work in a web portal with no integration required. See ATO Protect use cases and ATO Protect for IT Help Desk.

Frequently asked questions

What is vishing? Vishing is phishing conducted over a phone call. An attacker impersonates a trusted party, such as the IT help desk, a bank, or a colleague, and persuades the target to hand over credentials, share a one-time passcode, approve an authentication prompt, install remote access software, or move money. The word is a contraction of voice phishing.

What is the difference between vishing and phishing? The channel. Phishing arrives by email, smishing by SMS, and vishing by voice call. The practical difference is defensive: email has a decade of gateway and filtering technology in front of it, while a voice call reaches a person directly with almost no technical control in between.

How common are vishing attacks? Mandiant found voice phishing involved in 11% of all intrusions and in 23% of cloud intrusions, where it ranked as the leading vector (M-Trends 2026). State the denominator when citing these, because the two figures describe different populations.

What does a vishing attack look like? Typically a researched, unremarkable request rather than an emergency: a password reset, a locked account, a routine security check. The attacker has usually gathered organizational details from public profiles and personal details from breach data, may be calling from a spoofed number, and may direct the target to a lookalike help desk domain registered in advance.

Can you tell a cloned voice from a real one? Usually not. McAfee researchers produced an 85% voice match from three seconds of audio in one test using freely available tools, and 70% of people surveyed said they were not confident they could tell a clone from the real thing (McAfee Labs, 2023).

Why is the IT help desk the main enterprise target? Because it can reset passwords and rebind MFA through conversation alone, it is measured on speed and first-call resolution, and it routinely serves people who genuinely cannot authenticate. CISA documents attackers calling help desks to have passwords reset and MFA transferred to a device they control, then taking over accounts in single-sign-on environments.

How do you prevent vishing? Verify the person before granting the request, against a source they do not control. Checking a government-issued ID against the issuing authority, alongside SIM swap detection and man-in-the-middle detection, tests records the caller cannot alter. Awareness training, caller ID, callbacks, and knowledge questions each fail against a prepared attacker with a cloned voice.

Does multi-factor authentication stop vishing? Not on its own. These attacks generally do not defeat the second factor. They persuade someone to reset it, transfer it to an attacker-controlled device, or read the code aloud. MFA that can be reset by a phone call is only as strong as the verification performed on that call.

Vishing works because the person answering the phone has no way to check. That is a missing control, not a character flaw, and it is the part you can actually fix.