A vishing attack is a phone based social engineering attack in which a criminal impersonates a trusted person or organisation to extract passwords, passcodes, payments or system access. Modern vishing attacks are researched, scripted and often combined with email or text, and they were the entry point for some of the most expensive breaches of recent years.
Most people picture vishing as a clumsy robocall about a car accident, the attacks that hurt organisations look nothing like that. They are targeted, well informed and delivered by a confident caller who knows how a help desk works and what a finance team will believe. This guide walks through how a vishing attack unfolds, the techniques attackers use, real examples and what to do if one is happening to you.
For the definition and the basics, start with what is vishing in cyber security?. This article assumes you know what vishing is and want to understand how attacks actually work.
How does a vishing attack unfold?
A serious vishing attack has a lifecycle and understanding it is the best way to interrupt it.
It starts with reconnaissance, the attacker gathers names, job titles, reporting lines, phone numbers and recent events from LinkedIn, company websites, breached data, out of office replies and earlier phishing emails. The aim is to know enough to sound like an insider, where the target is a specific executive, the attacker may also collect voice samples from webinars, podcasts or social media.
Next comes the setup, many attacks prime the victim before the call: A text warning that IT will be in touch about a security issue, an email invoice with a number to call or a burst of multi-factor authentication prompts that makes a follow up call from "IT support" feel like a rescue. The attacker also prepares the technical props, spoofing the caller ID to match a genuine number and, in some cases, cloning a voice.
Then the call, the caller establishes credibility fast with the details they have researched, presents a problem that needs solving now and positions themselves as the person helping. Objections are expected and scripted for. If the victim wants to call back, the attacker offers a number that routes to them. If the victim hesitates, the stakes rise: the account will be locked, the payment will fail, the boss will be angry.
The extraction is the request itself: Read out the passcode, approve the prompt, install this tool so I can fix it, reset my password to this, change the supplier's account number. Often the victim does not say anything they consider secret. Approving a login prompt or installing a "support" tool feels harmless in the moment.
Finally, exploitation. With a reset password and a new MFA device, the attacker logs in, moves through email and shared systems, escalates privileges and either steals data, diverts payments or deploys ransomware. From the first call to a network wide incident can take hours rather than days.
What techniques do vishing attacks use?
Caller ID spoofing makes the call appear to come from a genuine number. It is cheap and widely available, and while Ofcom has tightened the rules on calls from abroad that display UK numbers, a familiar number on screen should never be taken as proof of anything.
Voice cloning uses AI to reproduce a specific person's voice from a short sample. Starling Bank's 2024 research found that three seconds of audio can be enough, that 28% of UK adults believed they had been targeted by a voice cloning scam in the previous year and that almost half were unaware the scam existed.
MFA fatigue, also called push bombing, floods a victim's phone with authentication approval requests using a stolen password, then follows up with a call from "IT" asking them to approve one to make the notifications stop.
Help desk impersonation reverses the usual direction, instead of calling the employee, the attacker calls the IT service desk as the employee and asks for a password or MFA reset, armed with enough personal detail to pass the checks.
Callback phishing, sometimes called telephone oriented attack delivery, uses an email or text with no link, just a phone number, so that nothing is there for filters to catch. The victim initiates the call, which makes them far more trusting of whoever answers.
Pretexting with authority uses the voice or name of a senior leader, a regulator or the police to short circuit the victim's judgement. Threats of arrest, fines or disciplinary action are common.
What are real examples of vishing attacks?
Marks & Spencer and the Co-op, 2025
In April 2025 both UK retailers suffered major ransomware incidents. The Cyber Monitoring Centre estimated the combined financial impact at between £270 million and £440 million and classified the events as a Category 2 systemic incident, noting that the intrusion likely began with social engineering, compromised credentials and potential abuse of IT help desk processes. Marks & Spencer later reported £101.6 million in direct incident costs. The attacks were widely attributed to a loosely affiliated criminal group known for phoning help desks while impersonating employees and requesting MFA resets.
MGM Resorts, 2023
In September 2023 the same style of help desk vishing brought down casino and hotel systems across the United States. The attackers reportedly used LinkedIn to identify an employee, then called the IT help desk posing as that person to obtain access. MGM put the cost of the disruption at around $100 million. Caesars Entertainment was hit by the same group weeks earlier and reportedly paid a ransom of around $15 million.
Uber, 2022
An attacker with a contractor's stolen password bombarded them with MFA prompts for over an hour, then contacted them on WhatsApp posing as Uber IT support and persuaded them to accept one. That single approval led to broad internal access and was reported by Uber's own security team as a social engineering attack.
Twitter, 2020
In July 2020 attackers used what Twitter described as a "phone spear phishing attack" on employees to gain access to internal tools, then took over high profile accounts to run a cryptocurrency scam. The point of entry was a phone call to staff, not a technical exploit.
The safe account scam, every day
The most common vishing attack in the UK never makes the news because it happens thousands of times a year to individuals. A caller from the "bank fraud team" reports suspicious activity and persuades the victim to move their savings to a "safe account" controlled by the criminal. UK Finance's Annual Fraud Report 2026 records £576.4 million lost to authorised push payment fraud in 2025, with scams originating by phone or text responsible for 28% of the losses from only 17% of the cases.
Who do vishing attacks target?
IT help desks and service desks are the prime corporate target, because they have the power to reset credentials and are measured on how quickly they resolve tickets. Finance and accounts payable staff are targeted for payments and supplier bank detail changes. Executives and their assistants are targeted for authority and access. New starters are targeted because they do not yet know who is who and are eager to be helpful. Remote and hybrid workers are targeted because a phone call from "IT" is a normal part of their day and they cannot walk over to check. And any employee with a mobile number in a breached database is a target for the personal scams that harvest details later used at work.
How do you detect a vishing attack in progress?
On the receiving end, the warning signs are consistent. The call is unexpected, the caller creates urgency and discourages you from ending the call to verify. They ask for something that no genuine process requires over the phone: a passcode, a password, a login approval, remote access, a payment or a change of bank details. They know personal details about you, which is intended to reassure. When you propose calling back on a number you already have, they resist. If you notice a flood of MFA prompts you did not trigger, someone already has your password, and any call that follows is part of the same attack.
For a help desk, the signals are a caller who cannot complete the normal verification, who pushes for an exception because they are travelling or in a hurry, who asks to change the phone number registered for MFA or whose request concerns a privileged or executive account.
If you suspect a vishing attack, end the call, verify through a known number and report it to your security team straight away. If a credential or approval has already been given, treat it as an incident: change the password, revoke active sessions, check for new MFA devices and mail forwarding rules and contact your bank if any payment is involved. Report losses to Action Fraud on 0300 123 2040 or at reportfraud.police.uk (Police Scotland on 101 in Scotland).
How do you defend against vishing attacks?
Start with the help desk, write a verification procedure for every credential or MFA reset that does not rely on information an attacker could research, and make it harder, not easier, for privileged accounts: a call back to the number already on file, a video check, confirmation from a line manager or an in person visit. Give service desk staff explicit permission to say no and to slow down, and measure them on that as well as on ticket times.
Harden authentication, enforce multi-factor authentication everywhere, turn off simple push approval in favour of number matching and move administrators and finance staff to phishing-resistant methods such as passkeys or hardware keys so that a talked through approval is not enough. Put a second person and a known number in the loop for every payment or bank detail change, with no exceptions for urgency.
Then train people on the pattern, the NCSC's guidance on defending against phishing stresses that people click, and by extension approve and comply, because they are busy, stressed or trying to help, and that punishing them only stops them reporting. Boxphish's cyber security awareness training covers social engineering and impersonation, including voice and text based scams, in short video and quiz based modules aligned to NCSC guidance. Staff learn to recognise urgency, authority and unusual requests wherever they arrive, and phishing simulations keep that recognition sharp under realistic pressure. Analysis of more than 400,000 Boxphish platform users found that untrained users are 8.8 times more likely to click a phishing link than trained users. The platform's analytics show which teams and locations still carry the most risk, and because it syncs users from Microsoft 365 and delivers training inside Microsoft Teams, it runs with minimal effort, which is what makes human risk management workable for a small IT team.
Vishing attacks in summary
A vishing attack is a researched, scripted phone call designed to obtain credentials, approvals, payments or access. The techniques are caller ID spoofing, voice cloning, MFA fatigue, help desk impersonation and callback lures, and the targets are help desks, finance teams, executives and anyone whose details have leaked. The retail attacks of 2025 showed what a single successful call can cost. The defences are a help desk that verifies properly, authentication that cannot be talked around and a workforce trained to end the call and check.
To see how Boxphish prepares staff for vishing attacks alongside email and text based threats, book a demo.
Frequently asked questions
What is a vishing attack?
A vishing attack is a phone based social engineering attack in which a criminal impersonates a trusted person or organisation to obtain passwords, passcodes, payments or system access. Targeted attacks on organisations are researched in advance, use spoofed caller ID or cloned voices and often begin with an email or text that sets up the call.
What are examples of vishing attacks?
The 2025 attacks on Marks and Spencer and the Co-op most likely began with social engineering of IT help desk processes. MGM Resorts was breached in 2023 after attackers phoned its help desk posing as an employee found on LinkedIn. Uber was breached in 2022 after MFA prompt bombing followed by a message from a fake IT support contact. The everyday UK example is the bank safe account scam.
How do attackers use MFA fatigue in vishing?
With a stolen password, the attacker triggers repeated login approval prompts on the victim's phone, then calls posing as IT support, apologises for the glitch and asks the victim to approve one to make the notifications stop. That approval gives the attacker access. Number matching and phishing-resistant MFA defeat this technique.
Why do vishing attacks target IT help desks?
Help desks can reset passwords and multi-factor authentication devices, are measured on resolving tickets quickly and deal with unfamiliar voices all day. An attacker who can pass the identity checks, usually with researched personal details, walks away with a working account without needing any technical exploit.
How do you stop a vishing attack?
End the call and verify through a number you already trust. Never read out a passcode, approve a prompt or install software at a caller's request. Report the call to your security team straight away. Organisations should harden help desk verification, use phishing-resistant MFA and train staff to recognise urgency, authority and unusual requests.
