Using phone calls to trick people into revealing credentials, payment details, or other sensitive information, often by impersonating a trusted organization.
Vishing is the voice version of phishing. The caller, either a live agent or a recording that transfers to one, poses as a bank, government agency, tech support desk, utility, or employer, and creates urgency so the target acts before thinking. Common goals include one-time passcodes, account logins, card numbers, gift card purchases, and remote access to a computer.
Spoofed caller ID is a frequent ingredient because a call that appears to come from the real organization's number is far more convincing. Increasingly, attackers also use synthetic or cloned voices to impersonate specific individuals. Some campaigns combine the call with a text message or email sent beforehand, so the call feels like a follow-up to something the target already received.
Targeted vishing against businesses, sometimes aimed at help desks or finance teams, can be low in volume and hard to spot in traffic data, while mass consumer campaigns look more like conventional robocalling. Both types rely on the target trusting what appears on the screen, which is why authenticated caller ID and accurate labeling matter so much.
Why it matters to carriers
Even though vishing targets end users, the calls cross carrier networks, and providers that originate or transit them can be identified through traceback. Strong attestation practices, Do Not Originate blocking for impersonated numbers, and responsive handling of abuse reports all help reduce the share of vishing traffic that touches your network.