What is vishing? Vishing is voice phishing: a scammer uses a phone call or voice message to talk someone into handing over money, credentials, or access. CISA calls it "the social engineering approach that leverages voice communication." In a business, the usual target is whoever can approve a payment, reset a login, or export data.

The technique is old. What has changed is the voice on the line, which can now be generated. This piece builds on how phishing actually works and how to spot it and covers the version that arrives by phone, including AI voice cloning, and the one control that holds up against it: calling back on a number you already have.

A vintage desk telephone with its handset lifted off the cradle, lit by a single hot pink light against black, for an article on what is vishing — A phone call carries authority and pace that an email cannot. That is the whole appeal for the caller.

What is vishing, and how is it different from email phishing?

Email phishing waits in an inbox. A call happens in real time, which is why Verizon's 2026 Data Breach Investigations Report files phone-based social engineering under pretexting: there is someone "on the other side of the phone" interacting with you as it happens.

That real-time element changes the psychology. I study behavioral psychology, and the most useful thing to know about a phone call is that it removes the pause email gives you. The caller sets the pace, answers objections as they come up, and raises the stakes the moment you hesitate.

Most business vishing runs on a few familiar scripts: an executive who needs an urgent payment, a bank or vendor "fraud team" asking you to confirm details, or an IT help desk asking for a code or a password reset. Each one borrows authority and adds a deadline. The same playbook without the phone is covered in what is pretexting, and the help desk version often ends in the push-approval trick described in what is MFA fatigue.

How common is vishing now?

CrowdStrike's 2026 Threat Hunting Report, published in August 2026, found that vishing intrusions in the first half of 2026 doubled compared with the second half of 2025. The figure comes from intrusions CrowdStrike itself observed, so read it as a direction of travel rather than a count for the whole economy.

The FBI's numbers point the same way. The IC3 2025 Internet Crime Report logged 22,364 complaints that referenced artificial intelligence, with adjusted losses above $893 million. The report notes that many victims do not realize how far AI was involved, so that number is a floor.

Financial regulators saw the shift early. In November 2024, FinCEN issued an alert on deepfake media reporting that, beginning in 2023 and continuing into 2024, financial institutions had filed more suspicious activity reports describing suspected deepfakes. The schemes it describes include criminals "impersonating an executive or other trusted employee and then instructing victims to transfer large sums."

A studio condenser microphone in an empty dark room with a hot pink rim light, representing the AI voice cloning behind modern vishing calls — A short clip of someone speaking is the raw material. Most executives have plenty of it online.

How does AI voice cloning change a vishing call?

It removes the old tell of an unfamiliar voice. The FBI warned in a December 2024 public service announcement that criminals use AI-generated audio "to impersonate well-known, public figures or personal relations to elicit payments," and use AI-generated clips of individuals to get into bank accounts. A May 2025 PSA added that for vishing, attackers "are more frequently exploiting AI-generated audio."

The FTC's guidance on family emergency scams describes the barrier plainly: "All he needs is a short audio clip of your family member's voice." For a company, that clip is rarely hard to find. Leaders speak on podcasts, webinars, conference panels, and social video.

The tools are within easy reach. In March 2025, Consumer Reports assessed six voice cloning products and found that four lacked meaningful safeguards against misuse, relying on a self-attestation checkbox. The FBI's July 2026 PSA describes scammers generating video for real-time chats "with alleged company executives," and warns that a cloned voice and a real one "can sound nearly identical."

The practical conclusion is uncomfortable but simple. Recognizing a voice can no longer count as verifying a person.

What did the Arup deepfake case actually show?

Arup, the engineering firm, confirmed to CNN in May 2024 that "fake voices and images were used" in a fraud against its Hong Kong office. According to Hong Kong police, an employee transferred about HK$200 million (roughly US$25.6 million) in 15 transactions to five local bank accounts after a video conference with what appeared to be senior colleagues.

The detail that matters is in the Hong Kong government's reply to the Legislative Council: police believe the call was a pre-recorded video conference built from public clips and voices, with no interaction between the victim and the fraudster. The fraud did not depend on real-time deepfake technology. It depended on familiar faces, a plausible meeting, and a payment process that let one person act on what they saw.

Arup said its "financial stability and business operations were not affected and none of our internal systems were compromised." That is the lesson for a $20 million company as much as a global one. No system was breached. A process was.

A conference speakerphone on an empty boardroom table glowing hot pink in the dark, the meeting setting used in deepfake vishing fraud — The Arup call looked like an ordinary internal meeting. Police believe it was pre-recorded.

What stops a vishing attack?

One rule does most of the work: hang up and call back on a number you already have. The FBI's May 2025 PSA tells people to "independently identify a phone number for the person and call to verify their authenticity." FinCEN's business email compromise advisory recommends verifying payment instructions "by using multiple means of communication or by contacting others authorized to conduct the transactions." The FTC gives the same advice for family emergencies: call the person at a number you know is theirs.

The number has to come from your own records: the vendor file, the staff directory, the signed contract. Never the number in the voicemail, the caller ID, or the email that set up the call. CISA is specific about this: do not use contact information connected to the request, and check previous statements instead.

Callbacks only work when they are required. Build them into the workflow so that a bank detail change, a wire above a set amount, or a help desk reset cannot complete without a recorded callback or a second approver. The case for friction explains why a deliberate pause belongs in these moments, and what is business email compromise covers the payment-change version in detail.

Two more habits help. Agree on a verification phrase among the people who can authorize money, which mirrors the FBI's December 2024 advice to families to "create a secret word or phrase." And make it safe to say no: the new hire who declines to wire funds on the CEO's voice alone should be thanked in public, which is the heart of building a security culture.

Regulation covers part of the ground. The FCC ruled in February 2024 that calls made with AI-generated voices are "artificial" under the Telephone Consumer Protection Act, which brings them under the Act's existing consent requirements. That helps against robocall campaigns. It does little against a single targeted call to your controller, so the callback rule stays yours to enforce.

An open address book with blank pages on a black desk under a narrow hot pink light, the known number you call back to stop vishing — The callback number comes from your own records, never from the call, the voicemail, or the email that set it up.

Not sure? Check before you act

When a call or message asks for money, credentials, or access, run through these steps. The full method is in how to check if a message is a scam.

Stop. Urgency is the tactic, and slowing down costs you nothing.
Read the real sender address or domain letter by letter. For a call, treat caller ID as unverified.
Look the company or person up yourself and call back on a number you already have.
Screenshot the message and ask your company's approved AI assistant whether the company is real, whether the domain matches, and whether it fits a known scam. Crop out customer and personal data, never upload attachments, and treat the answer as a second opinion.
Report it the way your company has set up, so colleagues get warned.
If money or a login was involved, call your bank right away to request a recall of the funds, and file a complaint at ic3.gov.

At Kief Studio we build the verification into the systems themselves, so a payment change or a login approval cannot go through on one person's say-so, however convincing the voice. We also run remote team sessions on exactly this: the calls and messages your staff actually receive and the checks that stop them. In-person sessions in Central Massachusetts are available, scoped in advance. Brian Gagne leads the security engineering, and briansgagne.com goes deeper on the technical side.

Frequently Asked Questions

What is vishing in simple terms?

Vishing is phishing by phone. A caller, or a recorded or AI-generated voice, pretends to be someone you trust, such as an executive, a bank, or IT support, to get you to send money, share a code, or grant access.

Can AI really clone a voice from a short recording?

Yes. The FTC warns that a scammer needs only "a short audio clip" of someone's voice, and the FBI says cloned and real voices "can sound nearly identical." Consumer Reports found in 2025 that four of six voice cloning products it assessed lacked meaningful safeguards against misuse.

Are AI voice robocalls illegal?

The FCC ruled in February 2024 that AI-generated voices count as "artificial" under the Telephone Consumer Protection Act, so those calls fall under the Act's existing consent requirements. The ruling does not ban every call that uses an AI voice, and it does not stop a targeted scam call.

What is the best defense against vishing at work?

A required callback on a number from your own records before any payment, bank detail change, or account reset goes through. The FBI, FinCEN, and the FTC all recommend verifying through a separate channel you already trust.

What should I do if someone on my team already sent money?

Call your bank immediately and request a recall of the funds. The FBI's 2025 Internet Crime Report says "time is of the essence." Then file a complaint at ic3.gov with the full transaction details, regardless of the amount.

Vishing

What Is Vishing? Voice Phishing in the Age of AI