Voice phishing (Vishing) is a type of fraud used by criminals to gain unauthorized access to sensitive data or financial information using social engineering techniques. Vishing is a type of social engineering attack in which the perpetrator uses a telephone or Voice over IP to pose as an authoritative figure or trusted entity in order to acquire personal information such as passwords or credit card numbers from the victim. Vishing is the criminal equivalent of phishing, which uses e-mails, social networking sites, and other spoofed websites to collect information.
Vishing attacks are often a form of confidence scam or a contact attempt to gain access to the victim’s account information. A typical attack may involve the hacker calling a victim claiming to be from a legitimate company and requesting a personal or account information such as a Social Security number, bank account number, or credit card details. The hackers may also ask for the number of the victim’s home phone, or for the victim to provide them with his or her account information. Once the hacker has gained the victim’s information, they can then use the account details to make fraudulent purchases or access accounts.
Vishing relies heavily on the skill of the attacker in order to be successful. The attacker must be convincing and have a full knowledge of how the targeted organization works in order to convince the victim that the caller is legitimate. Vishing attacks are typically conducted in bulk by automated dialers, in which the hacker calls a list of numbers and plays a pre-recorded message asking the receiving party for personal information.
Vishing attempts can be prevented by following sound security practices and being aware of the danger. In addition, it is important to be skeptical of any phone calls received that are requesting personal information. Organizations should also invest in tools and ideas for monitoring telephone attacks and provide user education on how to detect and respond to them.
