What is vishing? Voice phishing by phone, now with cloned voices. CrowdStrike found vishing intrusions doubled in the first half of 2026 versus late 2025. Here is how it targets businesses and the callback rule that stops it.
What is vishing? Vishing is voice phishing: a scammer uses a phone call or voice message to talk someone into handing over money, credentials, or access. CISA calls it "the social engineering approach that leverages voice communication." In a business, the usual target is whoever can approve a payment, reset a login, or export data.
The technique is old. What has changed is the voice on the line, which can now be generated. This piece builds on how phishing actually works and how to spot it and covers the version that arrives by phone, including AI voice cloning, and the one control that holds up against it: calling back on a number you already have.
Email phishing waits in an inbox. A call happens in real time, which is why Verizon's 2026 Data Breach Investigations Report files phone-based social engineering under pretexting: there is someone "on the other side of the phone" interacting with you as it happens.
That real-time element changes the psychology. I study behavioral psychology, and the most useful thing to know about a phone call is that it removes the pause email gives you. The caller sets the pace, answers objections as they come up, and raises the stakes the moment you hesitate.
Most business vishing runs on a few familiar scripts: an executive who needs an urgent payment, a bank or vendor "fraud team" asking you to confirm details, or an IT help desk asking for a code or a password reset. Each one borrows authority and adds a deadline. The same playbook without the phone is covered in what is pretexting, and the help desk version often ends in the push-approval trick described in what is MFA fatigue.
CrowdStrike's 2026 Threat Hunting Report, published in August 2026, found that vishing intrusions in the first half of 2026 doubled compared with the second half of 2025. The figure comes from intrusions CrowdStrike itself observed, so read it as a direction of travel rather than a count for the whole economy.
The FBI's numbers point the same way. The IC3 2025 Internet Crime Report logged 22,364 complaints that referenced artificial intelligence, with adjusted losses above $893 million. The report notes that many victims do not realize how far AI was involved, so that number is a floor.
Financial regulators saw the shift early. In November 2024, FinCEN issued an alert on deepfake media reporting that, beginning in 2023 and continuing into 2024, financial institutions had filed more suspicious activity reports describing suspected deepfakes. The schemes it describes include criminals "impersonating an executive or other trusted employee and then instructing victims to transfer large sums."
It removes the old tell of an unfamiliar voice. The FBI warned in a December 2024 public service announcement that criminals use AI-generated audio "to impersonate well-known, public figures or personal relations to elicit payments," and use AI-generated clips of individuals to get into bank accounts. A May 2025 PSA added that for vishing, attackers "are more frequently exploiting AI-generated audio."
The FTC's guidance on family emergency scams describes the barrier plainly: "All he needs is a short audio clip of your family member's voice." For a company, that clip is rarely hard to find. Leaders speak on podcasts, webinars, conference panels, and social video.
The tools are within easy reach. In March 2025, Consumer Reports assessed six voice cloning products and found that four lacked meaningful safeguards against misuse, relying on a self-attestation checkbox. The FBI's July 2026 PSA describes scammers generating video for real-time chats "with alleged company executives," and warns that a cloned voice and a real one "can sound nearly identical."
The practical conclusion is uncomfortable but simple. Recognizing a voice can no longer count as verifying a person.
Arup, the engineering firm, confirmed to CNN in May 2024 that "fake voices and images were used" in a fraud against its Hong Kong office. According to Hong Kong police, an employee transferred about HK$200 million (roughly US$25.6 million) in 15 transactions to five local bank accounts after a video conference with what appeared to be senior colleagues.
The detail that matters is in the Hong Kong government's reply to the Legislative Council: police believe the call was a pre-recorded video conference built from public clips and voices, with no interaction between the victim and the fraudster. The fraud did not depend on real-time deepfake technology. It depended on familiar faces, a plausible meeting, and a payment process that let one person act on what they saw.
Arup said its "financial stability and business operations were not affected and none of our internal systems were compromised." That is the lesson for a $20 million company as much as a global one. No system was breached. A process was.
One rule does most of the work: hang up and call back on a number you already have. The FBI's May 2025 PSA tells people to "independently identify a phone number for the person and call to verify their authenticity." FinCEN's business email compromise advisory recommends verifying payment instructions "by using multiple means of communication or by contacting others authorized to conduct the transactions." The FTC gives the same advice for family emergencies: call the person at a number you know is theirs.
The number has to come from your own records: the vendor file, the staff directory, the signed contract. Never the number in the voicemail, the caller ID, or the email that set up the call. CISA is specific about this: do not use contact information connected to the request, and check previous statements instead.
Callbacks only work when they are required. Build them into the workflow so that a bank detail change, a wire above a set amount, or a help desk reset cannot complete without a recorded callback or a second approver. The case for friction explains why a deliberate pause belongs in these moments, and what is business email compromise covers the payment-change version in detail.
Two more habits help. Agree on a verification phrase among the people who can authorize money, which mirrors the FBI's December 2024 advice to families to "create a secret word or phrase." And make it safe to say no: the new hire who declines to wire funds on the CEO's voice alone should be thanked in public, which is the heart of building a security culture.
Regulation covers part of the ground. The FCC ruled in February 2024 that calls made with AI-generated voices are "artificial" under the Telephone Consumer Protection Act, which brings them under the Act's existing consent requirements. That helps against robocall campaigns. It does little against a single targeted call to your controller, so the callback rule stays yours to enforce.
When a call or message asks for money, credentials, or access, run through these steps. The full method is in how to check if a message is a scam.
At Kief Studio we build the verification into the systems themselves, so a payment change or a login approval cannot go through on one person's say-so, however convincing the voice. We also run remote team sessions on exactly this: the calls and messages your staff actually receive and the checks that stop them. In-person sessions in Central Massachusetts are available, scoped in advance. Brian Gagne leads the security engineering, and briansgagne.com goes deeper on the technical side.
Vishing is phishing by phone. A caller, or a recorded or AI-generated voice, pretends to be someone you trust, such as an executive, a bank, or IT support, to get you to send money, share a code, or grant access.
Yes. The FTC warns that a scammer needs only "a short audio clip" of someone's voice, and the FBI says cloned and real voices "can sound nearly identical." Consumer Reports found in 2025 that four of six voice cloning products it assessed lacked meaningful safeguards against misuse.
The FCC ruled in February 2024 that AI-generated voices count as "artificial" under the Telephone Consumer Protection Act, so those calls fall under the Act's existing consent requirements. The ruling does not ban every call that uses an AI voice, and it does not stop a targeted scam call.
A required callback on a number from your own records before any payment, bank detail change, or account reset goes through. The FBI, FinCEN, and the FTC all recommend verifying through a separate channel you already trust.
Call your bank immediately and request a recall of the funds. The FBI's 2025 Internet Crime Report says "time is of the essence." Then file a complaint at ic3.gov with the full transaction details, regardless of the amount.
Business email compromise drew 24,768 FBI complaints and about $3.05 billion in reported losses in 2025. How vendor payment-change fraud works, the callback rule that stops it, and the first hour after a fraudulent wire.
What is quishing? Phishing hidden in a QR code, so nobody can read the link before scanning. The FBI warned in January 2026 that quishing pushes victims from work computers to phones, past email security controls.
MFA fatigue is push-bombing: login prompts sent again and again until one is approved. That is how an attacker got into Uber in September 2022, per Uber's own update. CISA calls phishing-resistant MFA the gold standard; here is what to switch on first.
Work With Us
Kief Studio builds, protects, automates, and supports full-stack systems for businesses up to $50M ARR.
Newsletter
Strategy, psychology, AI adoption, and the patterns that actually compound. No spam, easy to leave.
Subscribe
