What is vishing in cyber security? Definition, attack taxonomy and controls

Written for security teams, students and awareness trainers: how the frameworks define voice phishing, how real intrusions used it, and which controls actually stop it.

By the AI Voice Detector Editorial Team · Sources checked October 2026 · Vishing cluster

In cyber security, vishing (voice phishing) is a social engineering attack in which an adversary uses a phone call or voice message to manipulate a target into disclosing credentials, approving an authentication request, or transferring funds. MITRE ATT&CK catalogues it as Spearphishing Voice: T1566.004 for initial access and T1598.004 for reconnaissance. Controls are procedural and authentication-based.

How is vishing defined in cyber security frameworks?

Vishing is a portmanteau of voice and phishing. In security terms it is a social engineering technique, not a technical exploit: the vulnerability is a person's willingness to act on a request that sounds legitimate. The major frameworks place it as follows.

Framework	How vishing is defined or placed	Reference
CISA	Lists vishing alongside phishing and smishing as social engineering, defined as an attacker using human interaction to obtain or compromise information about an organisation or its systems, typically by posing as a trusted party.	CISA, Avoiding Social Engineering and Phishing Attacks
MITRE ATT&CK	Spearphishing Voice, T1566.004 (Initial Access): adversaries use voice communications to manipulate a user into granting access or executing an action. T1598.004 (Reconnaissance): the same technique used to elicit information for targeting.	MITRE ATT&CK T1566.004 · T1598.004
FBI IC3	Counts telephone impersonation inside Phishing/Spoofing: the use of unsolicited email, text messages and telephone calls purportedly from a legitimate company requesting personal, financial or login credentials.	IC3 2025 report, Appendix B
NIST SP 800-63B	Does not define vishing, but classes one-time codes delivered over the public telephone network as a restricted authenticator because of interception and social-engineering risk. This is the control gap most vishing exploits.	NIST SP 800-63B, 5.1.3.3

The practical definition we use on this site: a vishing attack is any use of voice communication, live, recorded or synthesised, to manipulate a target into disclosing a secret, approving an authentication event, granting access, or moving money. That covers a human caller reading a script, a robocall, a cloned executive on a video bridge, and a text message whose only purpose is to make the victim dial a number.

Diagram titled The vishing attack chain, and where it breaks. Five boxes show the stages of a voice phishing attack: research, pretext, spoofing the caller ID and cloning a voice, the pressured call, and the cash-out. Under each stage a box labelled Breaks here names the control that stops it. — The five stages of a vishing attack, and the control that breaks each one.

Where does vishing sit in the attack lifecycle?

Treating vishing as a single event hides the fact that it has distinct stages with distinct controls. Mapped against MITRE ATT&CK, a typical corporate vishing attack looks like this.

Stage	What the attacker does	ATT&CK mapping	Control point
1. Reconnaissance	Collect names, roles, phone numbers, org charts, vendor relationships, recent events; harvest voice samples from public video or earnings calls.	T1598.004 (Spearphishing Voice, Reconnaissance), T1589 (Gather Victim Identity Information)	Minimise public exposure of staff directories and executive audio; monitor for leaked employee data.
2. Pretext and infrastructure	Choose the identity to impersonate, write the script, acquire a spoofed caller ID, optionally build a voice clone.	T1585 (Establish Accounts), T1583 (Acquire Infrastructure)	Brand monitoring; register and attest own numbers under STIR/SHAKEN.
3. Contact	Place the call, or send a text that drives a callback. Target help desks, finance, executive assistants, new starters.	T1566.004 (Spearphishing Voice, Initial Access)	Awareness training with voice-specific simulations; a published callback rule.
4. Exploitation	Elicit credentials; obtain a one-time code; trigger an MFA push the user approves; persuade the help desk to reset MFA; obtain a remote session; obtain a payment approval.	T1621 (MFA Request Generation), T1078 (Valid Accounts), T1219 (Remote Access Software)	Phishing-resistant MFA; help desk identity verification; dual control on payments.
5. Objective	Account takeover, lateral movement, data theft, ransomware staging, or direct financial loss.	Post-compromise techniques vary by group	Session anomaly detection; rapid credential revocation; payment recall procedures.

What are the main types of vishing attack?

Eight patterns account for nearly all documented incidents. The first five are the ones that have breached well-defended organisations since 2022; the last three dominate consumer losses.

Type	Mechanism	Documented case	Source
Credential elicitation	Caller poses as IT or a vendor and asks the user to confirm or 'reset' a password on the call.	Twilio, June 2022	Twilio
MFA fatigue plus voice	Flood of push notifications, then a call from 'support' explaining the user should approve one to stop them.	Cisco, May 2022	Cisco Talos
One-time code relay	Attacker triggers a login; calls the user as IT or the bank and asks them to read the code that just arrived.	Retool, August 2023 (deepfaked IT voice)	Retool
Help desk reset	Attacker impersonates an employee to the service desk and requests a password or MFA reset, often armed with researched personal data.	MGM Resorts, September 2023; Scattered Spider pattern	CISA AA23-320A
Payment diversion / executive impersonation	Cloned executive voice, by phone or on video, instructs an urgent or confidential transfer.	UK energy firm, 2019; Arup, January 2024	CNN
Callback phishing (TOAD)	Text or email with a phone number; the victim calls, so the attacker inherits trust and bypasses call filtering. Often ends in remote-access installation.	Toll and bank-alert texts; tech support fraud, 2.13 billion dollars in 2025	FBI IC3 2025
SIM swap enablement	Vishing the carrier, or the victim, to port a number so SMS codes arrive on the attacker's device.	971 complaints and 17.4 million dollars in 2025	FBI IC3 2025
Consumer impersonation at scale	Bank fraud department, government agency, family distress call; increasingly with cloned voices.	3.5 billion dollars in imposter losses in 2025	FTC, June 2026

Case detail for each row, including what the callers said and what it cost, is in vishing examples.

Why does vishing bypass technical controls?

It targets the authentication step that was designed to stop phishing. Email filters and web proxies do not see a phone call. Multi-factor authentication based on codes or push approvals stops credential replay but not a user who is talked into reading the code aloud or tapping approve. NIST classified telephone-network OTP as restricted for this reason (NIST SP 800-63B, 5.1.3.3), and both the Cisco and Retool incidents turned on exactly that gap.

It exploits the help desk's job. Service desks exist to restore access quickly. An attacker who has researched an employee's details on social media and knows the reset script can walk through it. The FBI and CISA advisory on Scattered Spider describes this precisely: posing as IT or help desk staff by phone or SMS, then convincing help desk personnel to reset passwords or MFA tokens (CISA AA23-320A, updated 2025).

Caller identity is unauthenticated. Caller ID spoofing is trivial. STIR/SHAKEN attests that a number was not altered in transit on participating US networks; it does not verify the speaker and does not cover every route (FCC, call authentication).

Voice is no longer evidence of identity. The FBI's 2025 report records 22,364 AI-referenced complaints with about 893 million dollars in losses, and names voice cloning in business email compromise (over 30 million dollars in AI-involved BEC losses) and family distress scams (FBI IC3 2025 report, AI section). The 2024 Arup case, in which every participant on a video call was synthetic, is the end state: a control that relies on recognising a colleague has failed. The FCC's February 2024 ruling that AI voices are "artificial" under the TCPA helps prosecutors (FCC, 8 February 2024); it is not a control.

What controls reduce vishing risk?

Controls should be chosen against the types above, not against the idea of vishing in general. The table groups them by layer. The two with the largest measured effect in the incidents cited are phishing-resistant MFA and a help desk verification procedure with out-of-band callback.

Layer	Control	What it buys you
People	Role-specific training with voice simulations for help desk, finance, executive assistants and new starters. Teach the pattern (authority, urgency, secrecy, irreversible ask), not a list of scams.	Reduces exploitation rate; produces reports that feed detection.
Process	Written help desk verification that does not rely on researchable data (no date of birth, no employee ID alone); callback to a directory number for any reset, payment or bank-detail change; dual control above a threshold; a no-blame reporting route.	Addresses the help desk reset and payment diversion types directly. CISA AA23-320A recommends out-of-band verification for resets.
Technology: authentication	Phishing-resistant MFA (FIDO2 / WebAuthn security keys or platform passkeys) for all staff, mandatory for admins and finance; retire SMS and voice OTP per NIST SP 800-63B's restricted classification; number-matching on any remaining push MFA.	Removes the code and push approval the caller is trying to obtain.
Technology: telephony	Attest outbound numbers under STIR/SHAKEN so your brand is harder to spoof; publish the single number customers should call back; carrier-level spam labelling for inbound.	Partial. Reduces spoofing of your brand; does nothing for calls to staff mobiles.
Technology: detection	Alert on MFA resets by the help desk, new device enrolments, impossible-travel logins and remote-access tool installs within minutes of a reported call; keep call recordings for incident review.	Shortens dwell time between the call and the objective.
Technology: voice authenticity	Where calls or voicemails are recorded (contact centres, finance approvals), analyse suspicious audio for synthetic-speech probability as one input to the investigation.	Supporting evidence, not a gate. A clean result does not authorise a payment; the callback does.

Two cautions. First, awareness training alone has a ceiling: a well-run vishing call against a stressed employee will sometimes succeed regardless of training, so the process and authentication layers must assume a successful call. Second, do not replace one single point of trust with another. Voice-authenticity analysis is a useful input for investigators and contact centres, but a payment or a reset should never be approved because a detector said the voice was probably human.

How do you test and measure vishing resilience?

Run voice simulations, not just email ones. Target the help desk, finance and executive support with scripted calls and measure reset rate, code disclosure rate and callback compliance.
Track help desk verification failures as a metric, including near misses reported by staff.
Measure time from reported suspicious call to credential revocation. The Retool and MGM timelines show the damage happens in the hours after the call.
Audit MFA type by population. The percentage of staff on phishing-resistant methods is the single most predictive number for this attack class.
Review callback compliance on payments by sampling approvals above the dual-control threshold.

How is vishing covered in security training and certification?

Vishing appears in the social engineering sections of common security certification syllabi alongside phishing, smishing, pretexting and tailgating, and in most corporate security awareness programmes. For study purposes the points examiners expect are: vishing is a social engineering attack delivered by voice; it relies on authority, urgency and trust rather than a software vulnerability; caller ID is not authentication; one-time codes and MFA pushes are its usual target; and the primary controls are verification procedures, phishing-resistant MFA and user awareness. If you are building a training module, the documented cases on this site are all primary-sourced and safe to cite.

For the consumer-facing version of the defences, see how to protect yourself from vishing. For the channel comparison security teams are most often asked about, see vishing vs smishing. The parent explainer is what vishing is.

Frequently asked questions

What is vishing in cyber security?

In cyber security, vishing (voice phishing) is a social engineering attack in which an adversary uses a phone call, voicemail or synthesised voice to manipulate a target into disclosing credentials, approving an authentication request, granting access or transferring funds. MITRE ATT&CK catalogues it as Spearphishing Voice, T1566.004 for initial access and T1598.004 for reconnaissance.

Is vishing a type of phishing or a type of social engineering?

Both. Phishing is itself a social engineering technique; vishing is the voice-channel variant of phishing, as smishing is the SMS variant. CISA lists all three together under social engineering, and the FBI's IC3 counts telephone impersonation inside its Phishing/Spoofing category, which was the most reported crime type in 2025 with 191,561 complaints.

What is the difference between vishing and pretexting?

Pretexting is the fabricated scenario an attacker uses to justify a request, such as posing as the IT desk during a migration. Vishing is the delivery channel. Most vishing calls use a pretext, but pretexting also appears in email, text and in-person attacks. In an exam answer: pretexting is the story, vishing is the phone call that carries it.

Which MITRE ATT&CK technique covers vishing?

Two sub-techniques. T1566.004, Spearphishing Voice, under Initial Access, covers calls used to gain access or trigger an action, such as approving an MFA prompt. T1598.004, also named Spearphishing Voice, under Reconnaissance, covers calls used to elicit information for later targeting. Related techniques include T1621, Multi-Factor Authentication Request Generation.

What is the single most effective control against vishing?

Phishing-resistant multi-factor authentication, such as FIDO2 security keys or passkeys, removes the one-time code or push approval that most corporate vishing calls are trying to obtain. Pair it with a help desk verification procedure that uses out-of-band callback for any reset, which addresses the help desk pattern described in CISA advisory AA23-320A.

Can a voice detector prevent vishing?

No, and it should not be used as a gate. A detector can estimate the probability that recorded speech was machine-generated, which is useful evidence when investigating a suspicious voicemail or recorded approval call. It cannot verify who a live caller is. Authorisation should rest on callback to a known number and dual control, not an audio score.

Have a voicemail or call recording you are not sure about?
Run it through the free detector for a probability that the voice was machine-generated, then verify the caller through a channel you already trust.

Check a recording