Phone Phishing

Phone phishing, also known as voice phishing or vishing, is a form of fraud in which criminals use phone calls, voicemails or internet voice services to deceive victims into handing over sensitive information or moving money. Callers commonly pretend to be a bank's fraud team, a tax authority, the police, a delivery company or technical support for a well-known firm, and create a sense of urgency so the victim acts before thinking.

It is the voice-based branch of phishing, alongside email phishing and text-message scams, and it relies on social engineering rather than technical hacking. Phone phishing has become one of the most damaging forms of consumer fraud because a live, confident caller can answer doubts, guide victims step by step and override the warnings that banks and apps display.

Imagine answering the phone to someone who says they are from your bank, knows your name and the last digits of your card, and warns that a thief is emptying your account right now. They sound calm and professional, and the number on the screen even matches your bank's. All you need to do, they say, is read out a code or move your money to a "safe account".

That caller is the thief. The trick works because it turns a person's wish to protect their money into the very action that loses it. A useful rule is that a genuine bank will never ask for a full password or a one-time code, and will never ask a customer to move money to protect it.

• Caller ID spoofing. Fraudsters fake the number shown on the victim's phone so it appears to come from a bank or official body.
• Code harvesting. The caller triggers a login or payment and asks the victim to read out the one-time password sent by text, which lets them take over the account.
• Safe account scams. Victims are persuaded to transfer savings to an account the criminal controls, a classic form of authorised push payment fraud.
• Remote access. Fake support agents talk victims into installing remote-control software, then access banking apps or wallets directly.
• Hybrid attacks. A scam text or email asks the victim to call a number, so that the victim initiates contact and trusts the person who answers.
• Voice cloning. Advances in artificial intelligence allow criminals to imitate a relative's or executive's voice from short recordings.

Crypto holders are frequent targets because transfers are fast and usually irreversible. Callers pose as support staff from an exchange or wallet provider and claim that an account has been compromised. They may ask the victim to read out a seed phrase, approve a transaction, or move coins to a "secure" address. Some campaigns use leaked customer data, such as names, balances and recent activity, to sound convincing; in 2025 Coinbase disclosed that customer information obtained through bribed overseas support staff had been used in this kind of impersonation. Legitimate exchanges do not phone customers asking for recovery phrases or transfers. Related schemes are discussed under identifying cryptocurrency scams and SIM swapping, which hijacks a phone number to intercept security codes.

1. Hang up and call back. Contact the organisation using a number from its official website or the back of a card, not one given by the caller.
2. Never share codes or keys. One-time codes, passwords, PINs and seed phrases should never be read out to anyone.
3. Slow down. Pressure and urgency are warning signs; a genuine institution will allow time to check.
4. Use stronger authentication. App-based or hardware multi-factor authentication is harder to intercept than codes sent by text.
5. Agree family code words. A private word helps verify a relative who calls asking for urgent money, a defence against voice cloning.

Telecom regulators have pushed carriers to authenticate caller ID. In the United States, the Federal Communications Commission required major carriers to adopt the STIR/SHAKEN caller authentication framework from 2021. Banks use behavioural analytics and confirmation-of-payee checks to flag transfers made under coaching. In the United Kingdom, a mandatory reimbursement scheme for authorised push payment fraud on the Faster Payments system took effect in October 2024, sharing the cost between sending and receiving firms. Losses that move through money mule networks are often hard to recover, and many cases go unreported. Phone phishing also overlaps with the industrial-scale operations described under call centre scams and with account takeover.