--- id: CP-008 slug: vishing-voice-phishing-call-spoofing lang: en title: Vishing, voice phishing by phone description: "A fake IT support agent or a fake banker calls you and the screen shows a familiar number: how to recognise vishing and react." canonical_url: https://startbrain.io/cyberpedia/en/articles/vishing-voice-phishing-call-spoofing/ markdown_url: https://startbrain.io/cyberpedia/en/articles/vishing-voice-phishing-call-spoofing.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Vishing, voice phishing by phone", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/vishing-voice-phishing-call-spoofing/ (CC BY 4.0) wing: 1 theme: detect_phishing reflex: cr-019 schema: G1 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/vishing-voice-phishing-call-spoofing/ fr: https://startbrain.io/cyberpedia/fr/articles/vishing-arnaque-telephonique-usurpation/ de: https://startbrain.io/cyberpedia/de/articles/vishing-telefonbetrug-anrufer-taeuschung/ es: https://startbrain.io/cyberpedia/es/articles/vishing-estafa-telefonica-suplantacion/ sources: - "n": 1 title: Avoiding Social Engineering and Phishing Attacks | CISA publisher: CISA url: https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks published: "2021-02-01" accessed: "2026-11-03" - "n": 2 title: "Phishing for Information: Spearphishing Voice, Sub-technique T1598.004 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1598/004/ accessed: "2026-11-03" - "n": 3 title: "Phishing: Spearphishing Voice, Sub-technique T1566.004 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1566/004/ accessed: "2026-11-03" - "n": 4 title: Scattered Spider | CISA publisher: CISA url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a published: "2023-11-16" accessed: "2026-11-03" - "n": 5 title: Scattered Spider, Roasted 0ktapus, Octo Tempest, Storm-0875, UNC3944, Group G1015 | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/groups/G1015/ accessed: "2026-11-03" - "n": 6 title: Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction | Microsoft Security Blog publisher: Microsoft url: https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/ published: "2023-10-25" accessed: "2026-11-03" - "n": 7 title: "Phishing attacks: defending your organisation" publisher: NCSC (UK) url: https://www.ncsc.gov.uk/guidance/phishing published: "2018-02-05" accessed: "2026-11-03" - "n": 8 title: Remote Access Tools, Technique T1219 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1219/ accessed: "2026-11-03" --- # Vishing, voice phishing by phone Vishing (voice phishing) is phishing carried out by voice. The attacker phones while posing as a trusted person, to obtain information or an action from the victim. CISA describes it as the social engineering approach that relies on voice communication [1]. For an employee, the typical scenario is a call from someone pretending to be legitimate IT staff [3]. ## In 30 seconds - Where it happens: by phone, sometimes with a text message at the same time, among employees as well as at the IT help desk [4]. - What the attacker wants: a password, an authentication code, or the installation of a tool that gives them control of the computer [3][4]. - The reflex: check the caller's identity with the organisation they claim to represent [1]. - If it has already happened: tell the organisation's officials straight away, including network administrators, and change any passwords that were revealed [1]. ## Straight answers ### Does the number shown on the screen prove who is calling? No. Fraudsters can falsify their number while posing as a trusted entity, such as a business partner or technical support [2]. CISA states that voice over IP (VoIP) makes it easy to falsify the caller's identity, and that this exploits misplaced trust in the security of telephone services [1]. ### Who does the attacker impersonate? The sources cited here mention a business partner, a member of technical support [2], legitimate IT staff [3] and, in some cases, an employee who calls the help desk in place of the real account holder [4]. Microsoft also describes attackers posing as newly hired employees [6]. ### What are they trying to get? According to MITRE, the attacker may push the victim to open a malicious address, download malware or install remote management tools that the attacker can then use [3]. They may also try to obtain multifactor authentication credentials, or to get authentication requests accepted [3]. One of the groups described by CISA convinced employees to give it their one-time password (OTP), an authentication code [4]. ### Should you be wary of calls received after a message? Yes. A phishing message can ask the recipient to call a number back: MITRE speaks of «callback phishing» and says the attacker then tries to gather sensitive information [2]. ### What should you do about a suspicious call? CISA advises being wary of unsolicited calls from people asking about employees or internal information, and verifying the caller's identity directly with the organisation they claim to represent [1]. It adds that you should not give personal or organisational information unless you are certain the person is entitled to it [1]. ## Inside the attacker's head The attacker starts by gathering information. In CISA's advisory on the Scattered Spider group, the attacker first looks on professional sites for the targeted person's role in the company [4]. They then collect usernames, passwords and personal data [4]. Their calls, often several in a row, first serve to learn the password reset procedure, then to gather information specific to the targeted employee [4]. These calls rely on personal data from social media, open sources, commercial intelligence tools and database leaks [4]. Microsoft describes the same method: the actor studies the organisation, imitates the tone and vocabulary of the person being impersonated, and knows enough personal information to convince an administrator to reset a password or an authentication method [6]. This actor commonly targets technical administrators, such as support and help desk staff [6]. The attacker does not need to make the call themselves. According to MITRE, calls can be made by the attacker, by call centres hired for the occasion, or automated through prerecorded calls [2]. In rare cases, Microsoft has seen attackers resort to intimidation, with a home address, names of relatives and physical threats [6]. ## What you see on screen You see a number that looks familiar, or a name you think you recognise. Urgency or alarm is part of the scenario: MITRE notes that the attacker presents as a trusted source and creates a sense of urgency [3]. What follows varies. A caller may ask you for a one-time authentication code (OTP) [4]. They may also ask you to approve an authentication notification on your phone: CISA describes notifications sent repeatedly until the employee taps «Accept» (MFA fatigue) [4]. At other times, they guide you to a fake login portal or ask you to launch a remote access tool [5][4]. The text message may contain a link to a fake portal that imitates the company's authentication [6]. ## Under the hood Remote access tools are legitimate software. Microsoft notes that remote administration tools, misused by the actor it describes, have normal uses and that their use must be monitored in the environment [6]. MITRE cites examples such as AnyDesk [8]. MITRE specifies that these tools can be installed and then used after a compromise to establish an interactive remote desktop session [8]. Another mechanism is the hijacking of the number itself. CISA reports that Scattered Spider convinced telephone carriers to transfer a user's number to a SIM card in its possession (SIM swap), which gives control of the phone and of authentication requests [4]. Microsoft also describes setting up call forwarding on an employee's number, followed by a self-service password reset [6]. On the defence side, MITRE suggests monitoring the call logs of work devices and correlating them with events that follow the call, such as the installation of a remote management tool [3]. CISA asks for phishing-resistant multifactor authentication on all services where possible, and for continued training against vishing [4]. ## Case files ### Scattered Spider, June to December 2022 MITRE links to campaign C0027, from June to December 2022, calls and text messages in which the attacker posed as IT staff [5]. Victims were directed to a credential harvesting site or pushed to launch commercial remote management tools [5]. Once inside, the group searched the victims' documentation spaces for support instructions and for VPN and multifactor authentication enrolment guides [5]. ### Octo Tempest, 2022 and 2023 In its post of 25 October 2023, Microsoft describes a group first seen in early 2022, which initially targeted mobile carriers and outsourcing companies to trigger number transfers [6]. In 2022, it resold SIM swaps to other criminals and took over the accounts of wealthy individuals to steal their cryptocurrency [6]. Microsoft notes that it also called an organisation's help desk to get a password reset or an authentication factor added [6]. ### Update to the CISA advisory, July 2025 Advisory AA23-320A, published on 16 November 2023, was updated on 29 July 2025 with more elaborate social engineering techniques [4]. One of them is posing as an employee to obtain sensitive information from support, a password reset and the transfer of multifactor authentication to a device controlled by the attacker [4]. ## What you do Check the caller's identity directly with the organisation they claim to represent [1]. For a request received by email, CISA recommends not using the contact details from a site linked to the request, but looking for those in earlier communications [1]. The NCSC advises verifying an important request received by email through a second means of communication, such as a call or an in-person confirmation [7]. CISA describes a group that obtained one-time passwords from employees [4]. If you have already given in, report it without delay to the organisation's officials: they will be able to monitor unusual activity [1]. ## Sources 1. CISA, "Avoiding Social Engineering and Phishing Attacks | CISA", 1 February 2021. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (accessed 3 November 2026) 2. MITRE ATT&CK, "Phishing for Information: Spearphishing Voice, Sub-technique T1598.004 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1598/004/ (accessed 3 November 2026) 3. MITRE ATT&CK, "Phishing: Spearphishing Voice, Sub-technique T1566.004 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1566/004/ (accessed 3 November 2026) 4. CISA, "Scattered Spider | CISA", 16 November 2023. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a (accessed 3 November 2026) 5. MITRE ATT&CK, "Scattered Spider, Roasted 0ktapus, Octo Tempest, Storm-0875, UNC3944, Group G1015 | MITRE ATT&CK®". https://attack.mitre.org/groups/G1015/ (accessed 3 November 2026) 6. Microsoft, "Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction | Microsoft Security Blog", 25 October 2023. https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/ (accessed 3 November 2026) 7. NCSC (UK), "Phishing attacks: defending your organisation", 5 February 2018. https://www.ncsc.gov.uk/guidance/phishing (accessed 3 November 2026) 8. MITRE ATT&CK, "Remote Access Tools, Technique T1219 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1219/ (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/vishing-voice-phishing-call-spoofing/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.