How to protect yourself from vishing attacks: a 10-step defence

The defences that still work when the voice on the line is perfect, drawn from FTC, FBI and CISA guidance and the cases that taught them.

To protect yourself from vishing attacks, treat every unexpected call as unverified: hang up, then call back on a number you already hold. Never read out a one-time code, never move money to a 'safe account', and agree a family code word in advance. These habits work because they never rely on voice recognition, which AI cloning made unreliable.

Why can you no longer trust your ears?

For most of the history of phone fraud the weak point was the voice. A stranger could claim to be your bank but could not sound like your boss or your son. A voice clone built from a few seconds of public audio removes that check. The FBI's 2025 Internet Crime Report, the first with a dedicated artificial intelligence section, counted 22,364 complaints referencing AI with about 893 million dollars in losses, and named voice cloning specifically in family distress scams (over 5 million dollars) and in business email compromise (over 30 million dollars) (FBI IC3 2025 report, published April 2026).

So the defences below are procedural. None of them asks you to judge whether a voice is real. They work because they move the decision out of the call and into a channel the attacker does not control. The background on how these calls are built is in our vishing explainer; the cases that shaped this list are in vishing examples.

What are the 10 steps to protect yourself from vishing attacks?

1. Hang up, then call back on a number you already hold

   Not the number the caller gives you, not the one on the text, not the one caller ID shows. Use the number on the back of your card, in your contacts, or on the organisation's website typed by hand. This single habit defeats spoofed caller ID, cloned voices and callback scams at once, because the attacker cannot answer a number they do not control. The FTC's guidance on impersonation calls starts here: stop, hang up, and call the organisation at a number you know is correct (FTC, how to avoid a government impersonation scam).

2. Never read out, forward or type a one-time passcode for anyone who contacted you

   A one-time code proves to a website that you hold your phone. If you give it to a caller, you have just logged them in. No bank, agency, retailer or IT desk needs it from you (FTC, March 2024). Codes sent by SMS or voice call are classed as a restricted authenticator in NIST's digital identity guidelines precisely because they can be intercepted or socially engineered (NIST SP 800-63B, section 5.1.3.3). Where a service offers an authenticator app or a hardware key, switch.

3. Treat 'move your money to keep it safe' as proof of fraud

   The FTC's June 2026 release describes the costliest imposter pattern: a fake security alert, often from a bank, followed by instructions to move funds to protect them, with losses limited only by the victim's available balance (FTC, 15 June 2026). Your bank can freeze a card or block a transaction from its side. It never needs you to transfer anything.

4. Agree a family code word, and a callback rule at work

   A cloned voice can say anything except a word that was never recorded. Agree a short phrase with family now; anyone calling with an emergency has to say it. The FTC recommended this after warning that scammers were using AI to clone relatives' voices (FTC, 20 March 2023). At work, the equivalent is a rule that no payment instruction, bank-detail change or credential reset is actioned on a call alone; it is confirmed by callback to a directory number or by a second approver.

5. Do not trust caller ID, even when it matches

   Spoofing the displayed number is cheap and, outside narrow exceptions, illegal under the Truth in Caller ID Act, which has not stopped it (FCC, spoofing). The STIR/SHAKEN framework US carriers must implement attests that a number was not altered in transit on participating networks; it does not confirm who is calling (FCC, call authentication). A call that shows your bank's real number is still just a claim.

6. Slow the call down: urgency and secrecy are the method, not a detail

   Every vishing script imposes a clock and asks you not to tell anyone. The clock stops you thinking and the secrecy stops the one phone call that would end the scam. Say you will call back in an hour. A real emergency survives that. If the caller argues, you have your answer.

7. Learn the short list of things real organisations never do

   The FTC and the Elder Justice Coordinating Council ran a joint campaign in 2026 built on exactly this idea: a list of actions government and businesses will never take (EJCC, Never Ever campaign). Memorise the table below. If a caller does any of these, the call is over.

8. Lock down what makes you easy to target

   Add a PIN or port-freeze to your mobile account so your number cannot be swapped to a new SIM; IC3 logged 971 SIM-swap complaints and 17.4 million dollars in losses in 2025 (FBI IC3 2025 report). Set a voicemail PIN. Be sparing with public audio of yourself and family: a few seconds of clear speech is enough to clone a voice. Remove old phone numbers and relatives' names from public profiles where you can.

9. Protect older relatives specifically, before the call comes

   Americans over 60 reported about 7.7 billion dollars in losses to IC3 in 2025, more than a third higher than the prior year, with phishing/spoofing and tech support the two most reported crime types in that age group (FBI IC3 2025 report). Have the conversation now: agree the code word, put the bank's real number on the fridge, and agree that any call about money gets a second opinion from you. Consider a bank alert or a trusted-contact arrangement for large transfers.

10. Keep the recording, and verify the voice as well as the caller

    If the attempt came as a voicemail, or you recorded the call, keep it. It helps your bank and the police, and it lets you check whether the voice was synthesised. An audio detector can return a probability that the speech was machine-generated and, where it recognises the generator, name it. Use that as evidence, not as a verdict on its own; the callback on a known number is still the test that matters.

What will a real bank, agency or employer never ask on a call?

Six behaviours identify a vishing call regardless of who the caller claims to be or how they sound. The FTC states its own version plainly: it will never demand money, make threats, tell you to transfer money, or promise a prize (FTC, June 2026).

What should you do if you were targeted or already paid?

Act in the first hour and do not let embarrassment slow you down. These scams work on careful people; reporting is how the next one gets stopped. The FTC's checklist for people who have been scammed is the reference (FTC, what to do if you were scammed).

If the attempt was a text rather than a call, forward it to 7726 (SPAM) so your carrier can act on the sending number. If a voicemail was left, keep it; see step 10.

How do you protect a business from vishing?

The personal habits above scale, but a company needs them written down and enforced. The three controls with the best evidence behind them are: a help desk identity-verification procedure that does not rely on information an attacker can research (the joint FBI and CISA advisory on Scattered Spider describes attackers persuading help desks to reset passwords and MFA tokens (CISA AA23-320A)); phishing-resistant MFA such as FIDO2 security keys in place of codes and push approvals, which closed the gap exploited at Cisco in 2022 and Retool in 2023; and dual control on payments and bank-detail changes with callback to a directory number, which would have stopped the 2019 energy-firm transfer and the 2024 Arup transfers. The full taxonomy and control set is in vishing in cyber security.

What is the one-line version?

For how voice attacks compare with the text-message version of the same scams, read vishing vs smishing.

Frequently asked questions