15 Types of Vishing

Over the years and through ever-growing successes, vishing scam calls, or voice phishing attacks, have seen a surge in complexity and sophistication through the addition of increasingly complex tactics aimed to exploit human psychology and the perceived security of voice-based interactions. Here, we explore the different forms of vishing, each with unique approaches and methods. It’s interesting to note that different voice phishing types have successes with differing demographics, industries, and nationalities based on a number of factors.

AI-based Vishing

AI-based vishing fraud is a cutting-edge form of fraud where artificial intelligence is used to clone human voices. AI-based voice phishing has been used notably to imitate the voices of high-ranking officials or familiar figures, thereby tricking victims into believing they are speaking to a trustworthy source. In a prominent example from 2021, AI was used to replicate a company director's voice, convincing a bank manager to authorize a massive $35 million transfer. This voice phishing incident underscores the alarming potential of AI in cybercrime, especially with the wide availability of voice samples from various public domains.

Robocall Vishing

Robocall vishing fraud automates the process of making voice phishing phone calls to a large number of recipients, often across an entire area code. These voice phishing call types typically feature a pre-recorded message that prompts the recipient to provide personal information, which is then recorded and used for fraudulent purposes. According to McAfee, as stated by CNBC, 52% of Americans have shared their voice online. Despite their prevalence, the increasing public awareness of these calls, often characterized by their automated nature and the use of international or blocked numbers, has led to a higher rate of people recognizing and ignoring them.

VoIP Vishing

VoIP (Voice over Internet Protocol) scam call vishing leverages internet-based call technology, allowing scammers to generate fake numbers and carry out their schemes. This method can be combined with robocall tactics but often involves actual human callers to increase the scam's credibility. To prevent such attacks, using a sophisticated fraud detection system like AB Handshake is a superior option, given its call validation ability.

Caller ID Spoofing for Vishing Attacks

Caller ID spoofing is a particularly deceptive method for vishing scam calls that involves falsifying the caller ID to appear as if the call is coming from a legitimate, trusted institution, such as a tax agency or hospital, or, in this case, Microsoft. This creates a sense of urgency and compels the victim to share information they usually wouldn't.

Dumpster Diving for Vishing Attacks

In dumpster diving for vishing, attackers scavenge through a business’s waste to find documents containing personal data, which they then use to launch successful voice phishing scam call attacks. To counter this, businesses should adopt a policy of shredding all sensitive documents before disposal.

Tech Support Call Scams

Common in large companies, this voice phishing attack technique involves scammers posing as tech support personnel needing to perform an update or repair, asking for the victim’s password. Regular reminders to employees that legitimate tech support would never ask for passwords over the phone are essential in combating this form of vishing.

Voicemail Scams

These scams are often used as the precursor to dangerous voice phishing attempts and involve sending fake voicemail notifications via email, containing links that lead to malware-infected websites. Training users to recognize the signs of phishing in emails is crucial in avoiding this scam.

Client Call Scams

Here, scammers, often armed with information obtained through methods like dumpster diving, pose as clients of a company in voice phishing scam call attacks and request urgent invoice payments, creating a sense of immediacy to trick the victim into transferring funds. A dual-approval process for financial transactions can significantly mitigate the risk of these scams.

Whaling

Whaling, or CEO fraud, targets high-profile individuals within organizations, such as CEOs and other C-level executives. Scammers use spear-phishing techniques, often coupled with Business Email Compromise (BEC), to manipulate their targets into sending high-value wire transfers. In BEC, the attacker gains access to a corporate email account and then impersonates the account owner to request money or sensitive data from other organization members. This technique is often used in conjunction with voice phishing to establish a more convincing attack form.

Wardialing

Wardialing involves using technology to automatically dial a large number of phone numbers to uncover security flaws or unsecured modems. This method is a tool for hackers to gather personally identifiable information for various malicious purposes that is subsequently used to offer a richer and more detailed voice phishing form.

VoIP-based Attacks

Similar to standard VoIP vishing, these attacks involve creating phishing pages that mimic an organization's network login page, making voice phishing scam calls appear to originate from the same network. They often require multi-factor authentication, adding another layer of deceit.

Hybrid Vishing

Hybrid vishing, or hybrid voice phishing, combines email and telephone communication in phishing attacks. Attackers use various email impersonation tactics, such as using lookalike or spoofed domains and stolen branding, and include a telephone number for the victim to call, bridging the gap between digital and voice-based deception.

Reverse Vishing (Encouraging Callbacks)

Also known as reverse vishing, this technique involves leaving messages for victims, urging them to return a call about an urgent matter, often providing a case number for added legitimacy. Since the victim initiates the call, there's a higher likelihood of trust.

Pretexting with Bogus Emails

Pretexting employs fabricated stories to gain a victim’s trust, manipulating them into sharing sensitive information or sending money. It's a core tactic in targeted attacks like spear phishing, whaling, and BEC. Scammers create convincing characters and situations, often backed by thorough online research, to lure targets into their eventual voice phishing scam call traps.

Account Voice Phishing

This form of vishing fraud specifically targets account information such as passwords and bank details. Account phishing attackers often pose as authority figures or legitimate entities, urging the victim to reveal personal data supposedly for verification or security purposes. Awareness and skepticism of unsolicited calls asking for account details and verifying the caller's identity through independent means are vital in preventing such attacks.

Our Top Tip for Businesses: Implementing the AB Handshake System

Regardless of the method through which vishing fraud is used to cause severe monetary and reputational damages to businesses, operators, and individuals, ensuring you are equipped with industry-leading fraud prevention is crucial. Implement the AB Handshake system for robust defense against voice phishing, offering unparalleled call validation and fraud prevention to keep your telecommunications secure.

Careers

Project & Operations Coordinator

Product Manager