Vishing: What Employers Need to Know

Vishing — voice phishing — is social engineering conducted by phone call. The attacker impersonates someone with a plausible reason to ask: IT support needing a password reset, the payroll provider confirming details, an executive needing something handled urgently, a benefits administrator "verifying" enrollment data.

It deserves separate attention from email phishing because it defeats a different set of defenses. Email filters, link scanners, and banner warnings never see a phone call — the entire attack happens between two voices, in real time, with no artifact for technology to inspect.

Why voice works

A live call removes the pause that written messages allow. The target cannot reread, forward to a colleague, or hover over a link; they must respond now, to a person, with social pressure operating at full strength. Skilled callers use that: friendly authority, mild urgency, background office noise, and fluent use of names and details harvested from public sources or a previously compromised mailbox.

Caller ID makes it worse, because it can be spoofed trivially. A call displaying the payroll vendor's real number, or the CEO's cell, proves nothing — and most employees do not know that, which makes the display itself a tool of the fraud.

Voice cloning has raised the ceiling further: short samples of a person's voice — a conference talk, a voicemail greeting, social video — are enough to synthesize a convincing likeness. The practical consequence is blunt: a familiar voice is no longer verification.

The employer-facing scripts

• The IT support call — "we're seeing an issue with your account, I'll need you to read me the code that just arrived." The code is an MFA prompt the attacker triggered; reading it aloud hands over the account.
• The payroll vendor call — confirming banking or employee details "for the file conversion," aimed at HR and payroll staff
• The executive call — urgency plus authority, requesting a payment, a gift card purchase, or a data file, increasingly with cloned voice
• The help desk reversal — the attacker calls your help desk as the employee, requesting a password reset or MFA re-enrollment; the weakest verification in the building becomes the way in
• The benefits call to employees — "verifying" identity and enrollment data, timed to open enrollment when such calls seem normal

The help desk reversal deserves emphasis, because it inverts the usual training. It is not employees being called by fake support — it is support being called by fake employees, and it succeeds wherever reset procedures verify with information the caller can look up.

The defense: callbacks, not detection

Training people to "detect" vishing sets an unwinnable game — good callers are undetectable. The defense that works removes the judgment call entirely: nothing sensitive happens on an inbound call.

The standing rules, stated as procedure rather than advice:

• No credentials, MFA codes, or personal data are ever provided to an inbound caller — regardless of who they claim to be or what number displays
• Any request for a payment, banking change, or data file arriving by phone is completed only after a callback to a number from the directory or system of record — never a number the caller provides
• Help desk resets and MFA re-enrollments verify through callbacks or manager confirmation, not through recitable facts
• Urgency on a call is itself a signal — the legitimate version of every request survives a ten-minute callback delay

The callback discipline works because it swaps the channel the attacker controls for one they do not. It defeats spoofed caller ID, cloned voices, and perfect scripts equally, and it requires no one to out-judge a professional manipulator.

Making it stick

Vishing resistance is culture as much as procedure. Employees follow the callback rule when leadership has said, explicitly and repeatedly, that verification applies to calls that sound like the CEO, and that no one will ever be penalized for hanging up and dialing back. Include a vishing scenario in training — hearing a recorded example does more than a paragraph of description — and publicize near misses internally, because the caller who targeted payroll on Tuesday is calling accounts payable on Thursday.

Reports belong in the same escalation channel as everything else: one number, no blame, fast action — since a vishing attempt against one employee is reconnaissance against the organization.

Employer's Guardian helps employers train staff on voice-channel fraud and build the callback procedures that neutralize it through workforce training.

This article provides general educational information, not legal, tax, or insurance advice. Requirements vary by location, industry, and the data your organization handles.