What Is Vishing?
Vishing (voice phishing) is phone fraud where scammers impersonate banks, Medicare, or the IRS to steal personal data. Learn how to identify attacks.
Vishing — short for voice phishing — is a social engineering attack conducted by phone where the caller impersonates a trusted institution to manipulate the target into revealing sensitive personal information, authorizing fraudulent transactions, or providing access to accounts. Often paired with smishing (SMS phishing), the FTC's Consumer Sentinel Network data identified imposter scams as the highest-value fraud category by reported dollar losses, with consumers experiencing reported losses of $2.95 billion in 2024.
Common Vishing Scripts
- IRS / Tax Authority Impersonation: Caller claims there is an outstanding tax debt requiring immediate payment via wire transfer, gift cards, or cryptocurrency to avoid arrest. See our guide on IRS and Social Security scam calls.
- Bank Fraud Impersonation: Caller claims suspicious activity has been detected on your account and requests account credentials, card numbers, or one-time passcodes.
- Medicare / Social Security Impersonation: Caller requests your Medicare number or Social Security number to "update records." See our guide on Medicare scam calls targeting seniors.
- Tech Support Impersonation: Caller claims your computer has a virus and requests remote access.
- Grandparent Scam / Family Emergency: Caller impersonates a grandchild in distress. Read our analysis of AI voice cloning in grandparent scams.
Key Defense Principles
Vishing attacks rely on the victim's emotions — urgency, fear, authority, and concern for family. The countermeasure for every vishing script is the same: hang up and call back using a number you look up independently. No legitimate institution will penalize you for hanging up and calling their verified number.
Frequently Asked Questions
What is vishing?
Vishing (voice phishing) is a phone scam where callers impersonate trusted institutions — the IRS, Medicare, Social Security, banks, or tech support — to manipulate victims into revealing personal information, authorizing payments, or providing account access.
How do I know if a call is a vishing attack?
Key red flags: unexpected urgency or threats of arrest/account suspension, requests for payment via gift cards, wire transfer, or cryptocurrency, requests for one-time passcodes or full account credentials, and pressure to not hang up and verify independently. Legitimate institutions do not use these tactics.
What should I do if I receive a vishing call?
Hang up without providing any information. Look up the institution's verified phone number independently (not from the caller). Call that number to verify whether the issue is real. Report the vishing attempt to the FTC at ReportFraud.ftc.gov.
Stop the calls. No card required.
Callro's 26-layer Gauntlet Engine blocks robocalls, spoofed numbers, and scam callers before your phone rings. 7-day free trial.
Get Callro Free →