Understanding Vishing: A Growing Threat in Cybersecurity
Vishing, a blend of “voice” and “phishing,” is less of a direct cybersecurity threat and more akin to a scam. It involves attempts to steal information or money over the phone by deceiving the victim. Often, these calls leverage personal data obtained from previous cyberattacks to build trust with the victim.
The Rise of Vishing
This type of threat is on the rise, particularly with the advent of AI technologies. Like many other hacks and scams, Vishing is popular because it’s easy to execute, scales efficiently, and often succeeds. It also requires minimal technological investment and virtually no advanced coding knowledge—basic information readily available online suffices.
According to a recent TrueCaller survey, 26% of Americans lost money due to phone scams in 2022, highlighting the increasing prevalence of these attacks and the general lack of public awareness.
Common Vishing Tactics
The most typical Vishing tactic involves impersonating an authority figure, such as a government official, client, or coworker, to obtain sensitive information like social security numbers. These attacks can escalate to global threats if the victim is tricked into divulging critical information, such as computer passwords.
In rarer instances, scammers might persuade employees to wire money or pay fake invoices, thereby siphoning company funds. Regardless of the scam’s specifics, the best defense against these attacks is comprehensive user awareness programs.
This article explores seven common examples of Vishing to help your users recognize and avoid these traps.
1. AI-based Vishing
AI is becoming a pivotal tool in executing malicious schemes, including Vishing. AI can detect patterns and automate processes without constant human intervention, making it an ideal tool for social engineering scams.
Some AI software can now mimic a person’s voice, fooling employees into believing they are speaking with their superiors or managers. For instance, in 2021, a cyberattack involved voice cloning AI to impersonate a company director, convincing a bank manager to transfer $35 million during an acquisition process. This incident underscores the significant threat AI poses to organizations, with voice patterns readily available from social media, YouTube, interviews, etc.
2. Robocalls
Robocalls use prerecorded messages sent to numerous phone numbers in a specific area code via computer software. The automated voice prompts victims to provide personal information, which is then used for fraudulent activities.
Although these calls are common enough that many people recognize and ignore them, their prevalence remains a concern. Indicators of such attacks include international or blocked numbers, as scammers frequently change numbers to evade detection.
3. VoIP (Voice over Internet Protocol)
While VoIP technology offers significant business advantages, scammers can exploit it to create fake numbers for their attacks. This method can be combined with robocalls but often involves human callers.
To thwart these calls, ask for additional information to be sent via email, where attacks are easier to identify, or request in-person discussions, which scammers typically cannot accommodate.
4. Caller ID Spoofing
Caller ID spoofing uses software to display a fake caller ID, often impersonating institutions like tax agencies, police departments, or hospitals to create urgency and extract sensitive information from victims.
These attacks are challenging to detect. The best defense is to switch communication to another medium, such as email. Some phones and security measures can identify and block spoofed caller IDs.
5. Dumpster Diving
Dumpster diving involves retrieving information from discarded company documents. These documents often contain sufficient personal data to launch a successful Vishing attack.
To counter this, companies should shred all sensitive documents before disposal. Investing in shredders or using external shredding services can mitigate this risk.
6. Tech Support Call
Common in large organizations where employees may not know all tech support staff, scammers pose as tech support personnel needing to update or repair computers, requesting the victim’s password.
Education is crucial to preventing these attacks. Regularly remind employees never to share passwords over the phone and to report any suspicious calls.
7. Voicemail Scam
This scam involves fraudulent emails mimicking voicemail notifications. The emails contain links that, when clicked, download malware onto the user’s device.
Training users to recognize phishing emails is essential. Look for signs like spelling errors, improperly sized logos, and non-official domain names in suspicious emails.
8. Client Call
Scammers often use old invoices found through dumpster diving to pose as clients requesting urgent invoice payments. This scam highlights the need for a two-person approval process for any invoice payments or wire transfers, ensuring another person can review and potentially detect fraudulent attempts.
The Importance of Education
Vishing is on the rise, and the best defense is educating users about these scams. Vishing simulations should be part of your cybersecurity awareness training campaigns. Testing your organization’s vulnerability and adjusting defenses accordingly is crucial. Hackers exploit mundane situations to lower defenses, so training users to recognize these scenarios and their signs is the most effective way to prevent Vishing attacks.
