What is vishing?
Vishing is a phone-based phishing scam where a caller impersonates a trusted organization to trick you into sharing sensitive information or sending money. The caller might claim to be your bank, the IRS, a tech support agent, your phone provider, or “fraud department.” The scam works because it’s live: the scammer controls the conversation, creates urgency, and pressures you to act before you can verify.
How phone phishing scams usually work
- They create urgency: “Suspicious charge,” “account locked,” “warrant,” or “final notice.”
- They establish authority: bank/agent titles, “case numbers,” official-sounding scripts.
- They demand action: confirm identity, read a code, install an app, or send money.
- They isolate you: “Don’t tell anyone,” “stay on the line,” “this is confidential.”
Top vishing red flags
- Pressure to act immediately
- Requests for one-time passcodes, passwords, or MFA codes
- Payment requests via gift cards, crypto, wire, or “safe account” transfers
- Threats of arrest, fines, or account shutdown
- Refusal to let you hang up and call back using an official number
The safest way to verify a phone call
Treat the incoming call as untrusted. Hang up. Then verify using official channels: open your bank’s app, type the website yourself, or call the number on the back of your card. This single step breaks most vishing scams because the scammer loses control.
Practice phone scam detection
Practice Vishing Scenarios Use Scam Lookup
FAQ
Is vishing the same as phone scams?
Vishing is a major category of phone scams focused on stealing information or money by impersonating trusted organizations.
Will my bank ask for my one-time passcode?
No. A bank may verify identity, but they should not ask you to read back a one-time passcode sent to your phone.
What should I do during a suspicious call?
Hang up, then verify using an official number or the official app. Don’t stay on the line under pressure.