Many phishing attacks take the form of emails pretending to be from a legitimate entity to trick victims into divulging private information like passwords and personal data. But today, cybercriminals are taking it a step further by leveraging voice calls to achieve the same goal.
In this blog post, we will discuss what vishing is, how it works, and how it’s currently affecting businesses. We’ll also explore how a managed security services provider like Techmedics can help reduce the risk posed by such threats.
Short for voice phishing, vishing is a type of phishing attack wherein threat actors use phone calls to trick unsuspecting victims into providing sensitive data like credit card numbers or login credentials. Subsequently, these details can be exploited for financial theft, identity theft, or fraud.
Vishing attacks take several forms, all crafted to exploit victims’ fear and sense of urgency. Common examples include:
According to CrowdStrike’s 2025 Global Threat Report, vishing attacks jumped 442% between the first and second half of 2024. By the first six months of 2025, the volume of vishing attacks recorded had already surpassed the entire 2024 total.
Vishing-related security incidents have recently made headlines, with each attack resulting in major financial losses or significant operational disruptions:
In 2023, hospitality and entertainment company MGM Resorts suffered a ransomware attack where hackers posed as IT helpdesk staff over the phone. Employees were tricked into resetting account credentials, giving the attackers access to MGM’s systems.
This allowed them to deploy ransomware, resulting in the shutdown of slot machines, hotel check-in systems, and digital keys. Worse yet, it caused multiple days of disruption and a loss of roughly $100 million.
In March 2019, attackers used AI-cloned audio of an unnamed UK energy firm’s CEO to trick staff into sending €220,000 (~$243,000) to a fraudulent account. With the victim believing he was indeed speaking with his superior, he transferred the funds.
While the scammer called back twice more for additional transfers, the company’s director became suspicious when a promised reimbursement never arrived, and the call had been made with an Austrian number.
In July 2020, cybercriminals posed as the IT staff of social media platform Twitter (now X) over the phone and targeted employees with access to internal tools. They convinced staff to log into a fake portal, bypassing the company’s cybersecurity defenses.
As a result, the attackers gained control of various high-profile accounts and ran a cryptocurrency scam that earned about $117,000.
As cybercriminals constantly craft sophisticated vishing attacks, businesses should remain a step ahead. Here are some measures you can take to protect against this threat:
Remind your staff that cybercriminals can fake caller IDs to display trusted names, such as a business partner or the IT helpdesk. Attackers may also pressure your employees with phrases like “Act immediately” or “Your account will be locked.” If they are suspicious of a certain call, teach them to hang up and call back using official numbers.
Moreover, it helps to simulate vishing scenarios through role-play exercises or recorded call simulations. This way, employees experience the pressure of such threats and learn to respond appropriately.
MFA is a security framework where a user provides two or more proofs of their identity to gain access to a device, application, or account. This could take the form of a unique code, access badge, or fingerprint scans.
By enabling MFA, organizations can reduce the likelihood of unauthorized account access, even if credentials are compromised.
Vishing attacks aren’t limited to your employees, as cybercriminals may also impersonate your vendors or use compromised vendor accounts to call your staff. This makes their attempts more believable.
As such, your business should regularly review your vendors’ security practices throughout the relationship. This includes periodic reviews of their security practices and business continuity preparedness. What’s more, your organization should prepare for vendor downtime by having redundant systems or alternate providers.
Dealing with evolving cyberthreats like vishing can be difficult on your own. A reliable managed security services provider (MSSP) like Techmedics is here to help. We provide comprehensive cybersecurity services to businesses, including:
We serve businesses in Dallas, Denver, Las Vegas, Los Angeles, and Phoenix, regardless of industry.
To learn more about how Techmedics can improve your business’s cybersecurity posture and improve your resilience against threats, request a consultation today.
Technology challenges rarely have one-size-fits-all solutions. A consultation with Techmedics can help you better understand your options and identify practical next steps for your organization. Start with a conversation about what you're trying to accomplish and where technology may be getting in the way.
