Vishing examples: 12 real voice phishing attacks and what they asked for
Real cases, with the script the caller used, what they wanted, what it cost, and where the numbers come from.
Vishing examples include a cloned chief executive's voice that ordered a 220,000 euro transfer in 2019, a help desk call that opened MGM Resorts in 2023, and fake bank fraud-department calls that cost US consumers nearly 1 billion dollars in 2025. Each shares one pattern: a trusted identity, an urgent story, and a payment or code that cannot be recalled.
What do real vishing attacks look like?
The table below lists twelve documented vishing examples. Each row names the pretext the caller used, what they asked the target to do, what happened, and the primary source. Corporate cases are drawn from the victims' own disclosures or regulator filings. Consumer patterns are drawn from the Federal Trade Commission (FTC) and the FBI's Internet Crime Complaint Center (IC3), which published its 2025 figures in April 2026.
| When | Target | Pretext | What they asked for | Outcome | Source |
|---|---|---|---|---|---|
| 2019 | UK energy firm | Caller used a cloned voice of the German parent company's chief executive and demanded an urgent supplier payment within the hour | Wire transfer | 220,000 euros sent, per the insurer Euler Hermes | WSJ, Aug 2019 |
| Jun 2022 | Twilio | Employee talked into handing over credentials by phone (Twilio calls it vishing); the same actors later ran a text campaign against staff | Login credentials | Customer contact data for a limited number of customers accessed | Twilio incident report, 2022 |
| May 2022 | Cisco | Repeated calls over several days from people posing as support organisations the employee trusted, combined with MFA push flooding | MFA approval, new device enrolment | VPN access, then internal network; Cisco reported no customer or product impact | Cisco Talos, Aug 2022 |
| Aug 2023 | Retool | Text message about a payroll issue led to a fake login page, then a phone call in which the attacker imitated an IT staffer's actual voice | One MFA code | 27 cloud customer accounts compromised | Retool, Sep 2023 |
| Sep 2023 | MGM Resorts | Caller impersonated an employee to the IT help desk and asked for an account reset | Password or MFA reset | Roughly 100 million dollar hit to adjusted property EBITDAR, per the company's 8-K | MGM 8-K, Oct 2023 |
| Jan 2024 | Arup (Hong Kong office) | Finance worker joined a video call in which the CFO and colleagues were all deepfake recreations, voice and face | 15 transfers | About 25.6 million US dollars (200 million HKD) | CNN / Hong Kong police, Feb and May 2024 |
| Jan 2024 | New Hampshire voters | Robocall using an AI-cloned voice of President Biden told Democrats not to vote in the primary; caller ID was spoofed | Voter suppression, not money | FCC fined the consultant 6 million dollars; the carrier paid 1 million | FCC, Sep 2024 |
| 2023 to 2025 | Families (grandparent / distress scam) | Cloned voice of a child or grandchild in an accident or arrest, asking for bail, fees or a courier pickup | Gift cards, cash, wire | Over 5 million dollars reported lost to distress scams in 2025 | FBI IC3 2025 report |
| 2025 | Bank customers | Fake fraud alert from the bank, then a call from the 'fraud department' instructing the customer to move money to a safe account | Transfers, one-time passcodes | Business impersonation losses near 1 billion dollars in 2025, highest to bank impersonators | FTC, Jun 2026 |
| 2025 to 2026 | US consumers | Government impersonation: IRS, Social Security, police, jury duty warrants, and toll agencies, often text first and call second | Payment to cancel a warrant or fine | About 920 million dollars lost to government impersonators in 2025; reports up 40% | FTC, May and Jun 2026 |
| Ongoing | Online sellers | A 'buyer' calls or texts asking you to read back a Google Voice verification code to prove you are real | Verification code | Attacker gets a phone number tied to your identity to scam others | FTC, Oct 2021 |
| 2025 | Older adults | Tech support call or pop-up directing the victim to phone a number, install remote access, then move money to 'protect' it | Remote access, transfers | Tech support fraud: 47,794 complaints and 2.13 billion dollars in 2025 | FBI IC3 2025 report |
Dollar figures are as reported by the cited source. The FTC and IC3 both note that most fraud is never reported, so these are floors, not totals.
Which vishing examples hit companies?
Corporate vishing rarely asks for money directly. It asks for access, and the money follows. Five cases show the full range.
2019: the first publicly reported cloned-voice wire fraud
The chief executive of a UK energy firm took a call from someone he believed was his boss at the German parent company. The voice carried the right accent and cadence. The caller asked for an urgent 220,000 euro payment to a Hungarian supplier within the hour. The money went, and the insurer Euler Hermes later told the Wall Street Journal (August 2019) that the voice had been generated with AI software. This is the earliest widely cited example of a voice clone used in a vishing attack, and the script has not changed since: authority, urgency, a one-hour deadline.
2022: Twilio and Cisco, credentials and MFA by phone
Twilio's incident report describes a June 2022 case in which an employee was socially engineered by voice phishing into providing credentials, giving the attacker access to contact data for a limited number of customers. Weeks later the same actors ran a text campaign against Twilio staff with fake Okta login pages. Cisco's Talos write-up (August 2022) describes a May 2022 intrusion in which an employee received multiple calls over several days from people posing as trusted support organisations, combined with a flood of MFA push notifications until one was accepted. The attacker then enrolled new devices for MFA and authenticated to the VPN.
2023: MGM Resorts and the help desk call
The September 2023 MGM Resorts incident began, according to the group's own statements to the press and the pattern described in the joint FBI and CISA advisory on Scattered Spider (AA23-320A), with a phone call to the IT help desk impersonating an employee and requesting a reset. MGM's 8-K filing of 5 October 2023 estimated a negative impact of approximately 100 million dollars on adjusted property EBITDAR for the quarter. No malware was needed for the first step. A convincing phone manner was enough.
2023: Retool and the deepfaked IT voice
Retool's post-mortem is the clearest public example of smishing and vishing chained together. On 27 August 2023 employees received texts about a payroll problem pointing to a fake login page. One employee signed in. The attacker then phoned that employee, imitating the actual voice of an IT team member, and asked for a multi-factor code. That one code let the attacker add their own device to the employee's Okta account; 27 cloud customers were affected. Retool noted that a cloud-sync feature in the authenticator app turned the second factor into a single one.
2024: Arup and the all-deepfake video call
Hong Kong police briefed in February 2024 that a finance worker at a multinational had transferred 200 million Hong Kong dollars (about 25.6 million US dollars) over 15 transactions after a video call in which the chief financial officer and every other participant were deepfake recreations (CNN, 4 February 2024). The engineering firm Arup later confirmed it was the victim (CNN, 16 May 2024). The worker had initially been suspicious of a message about a confidential transaction; the familiar faces and voices on the call removed the doubt. That is the vishing mechanism in its most advanced form.
What are the most common vishing examples for consumers?
Consumer vishing is high volume and formulaic. The FTC's June 2026 release reports that people lost 3.5 billion dollars to imposter scams in 2025, that imposter scams were nearly one in three fraud reports, and that losses to all fraud reached about 16 billion dollars, up about 25% on 2024 (FTC, 15 June 2026). Five scripts account for most of the calls.
The bank fraud department
You get a text or an automated call about a suspicious charge. You call back, or they call you, and a calm agent from the "fraud department" walks you through moving your balance to a new account to keep it safe. The FTC singles this out as one of the costliest patterns: losses to business impersonators were nearly 1 billion dollars in 2025, with bank impersonators the largest share (FTC, June 2026). Banks do not ask you to move money to protect it, and they do not ask for the passcode they just sent you.
Government impersonation: IRS, Social Security, police and tolls
Reports of government imposter scams rose 40% in 2025, driven partly by unpaid-toll messages that spoof real toll programmes and threaten late fees or a suspended registration (FTC consumer alert, 7 May 2026). Losses to government impersonators were about 920 million dollars (FTC, June 2026). A recurring 2026 variant is the jury duty call: you missed jury service, there is a warrant, and the "officer" can clear it for a payment today (FTC alert, 11 June 2026). IC3 counted 32,424 government impersonation complaints in 2025 with about 798 million dollars in losses (FBI IC3 2025 report).
The family emergency, now in a cloned voice
The grandparent scam is decades old. What changed is the voice. The FTC warned in March 2023 that scammers were using AI to clone a relative's voice from a short public clip and make the emergency call sound exactly right (FTC, 20 March 2023). The FBI's 2025 report, the first to break out AI-enabled crime, records more than 5 million dollars in losses to these "distress" scams in 2025 and notes the script is expanding to other family members and friends (FBI IC3 2025 report, AI section). We cover the mechanics in our piece on the grandparent scam.
The verification code
A buyer for something you listed online says they need to confirm you are a real person and asks you to read back a code that just arrived by text. The code is a Google Voice verification; handing it over gives the caller a phone number tied to you, which they then use to scam others (FTC, October 2021). The general rule the FTC repeats: a verification code is never something to read out to someone who contacted you (FTC, March 2024).
Tech support
A pop-up or a call says your computer is infected or your account is compromised. The fix requires remote access and, eventually, moving money. IC3 logged 47,794 tech support complaints and 2.13 billion dollars in losses in 2025, and tech support is the second most reported crime type among complainants over 60 (FBI IC3 2025 report).
Can vishing be political rather than financial?
Yes. In January 2024, New Hampshire voters received robocalls in a cloned voice of President Biden urging them not to vote in the primary, with caller ID spoofed to a local political figure. The FCC responded in two ways. On 8 February 2024 it issued a declaratory ruling that AI-generated voices count as "artificial" under the Telephone Consumer Protection Act, making such robocalls illegal without prior consent (FCC, 8 February 2024). In September 2024 it fined the consultant behind the calls 6 million dollars (FCC forfeiture order, September 2024), after the carrier that transmitted them agreed to a 1 million dollar penalty (FCC, August 2024).
What do all vishing examples have in common?
Strip away the pretext and the twelve cases share four levers. Recognising any one of them is enough to stop and verify.
| Lever | How it shows up in the examples | The counter |
|---|---|---|
| A borrowed identity | Bank fraud team, IT help desk, the CEO, a grandchild, a court officer. Caller ID is often spoofed to match. | Verify the person through a channel you already hold, not the one they gave you. |
| A reason it cannot wait | A transfer leaving your account, an arrest, a payroll cut-off, a vendor deadline in the next hour. | Real institutions survive a ten-minute delay. Hang up and call back. |
| A reason to keep quiet | 'Do not tell your family.' 'This is a confidential acquisition.' 'The branch staff may be involved.' | Secrecy is the tell. Tell someone before you act. |
| An irreversible payment or an unrecoverable secret | Wire, gift cards, crypto, cash to a courier, a one-time passcode, a remote-access session. | No legitimate caller needs any of these from you on the spot. |
How has AI voice cloning changed vishing?
Until recently the weak point in every vishing script was the voice. An actor could sound like a bank, but not like your CFO or your daughter. A clone built from seconds of public audio removes that limit. The FBI's 2025 Internet Crime Report added an artificial intelligence section for the first time: 22,364 complaints referenced AI, with adjusted losses of about 893 million dollars, and it names voice cloning in business email compromise (over 30 million dollars in AI-involved BEC losses) and in distress scams (FBI IC3 2025 report, pages 39 to 42). The 2019 energy-firm case and the 2024 Arup case bracket the shift: one cloned voice on a phone, then an entire cloned meeting on video.
The practical consequence is that recognising a voice is no longer verification. The defence has to be procedural: a callback on a known number, a code word, a second approver on payments. Our step-by-step guide to protecting yourself from vishing covers each of these. If you have a recording of the call or voicemail, a detector can give you a probability that the speech was synthesised, which is useful evidence for a report, though it is not a substitute for calling back.
How do you recognise a vishing call while it is happening?
- The caller already knows things about you. Name, bank, employer, last four digits. That is a sign of research, not legitimacy.
- They want you to stay on the line. Real institutions are happy for you to hang up and call the number on your card.
- They ask for a code, a password, remote access, or a transfer. Any one of these ends the call.
- The payment method is strange. Gift cards, crypto, wire to a new account, cash to a courier.
- The voice sounds right but the behaviour is wrong. A relative who will not answer a question only they could answer, or a boss who insists on secrecy.
For how vishing differs from the text-message version of the same scams, see vishing vs smishing. For the formal definition and controls used by security teams, see vishing in cyber security. The parent explainer is what vishing is and how it works.
Frequently asked questions
What is a vishing example?
What is the most common vishing scam?
Is the grandparent scam a form of vishing?
Was the MGM Resorts attack vishing?
Can you tell if a vishing call used an AI voice?
Run it through the free detector for a probability that the voice was machine-generated, then verify the caller through a channel you already trust.