{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/vishing","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/vishing/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/vishing/"},"term":{"en":"Vishing","da":"Vishing (telefonsvindel)"},"aka":{"en":["voice phishing","phone scam"],"da":["telefonsvindel","voice phishing"]},"domain":["security"],"cluster":"awareness","layer":"people","status":"current","era":2006,"summary":{"en":"Tricking people over the phone or a voice call into giving away information, codes or money.","da":"Svindel via telefon eller taleopkald, hvor folk narres til at udlevere oplysninger, koder eller penge."},"body":{"formal":{"en":"A form of social engineering carried out by voice, where the attacker poses as a bank, IT support or a manager and uses tone, urgency and a faked caller number to push the target into acting at once; newer versions use a computer-made copy of a known person's voice.","da":"En form for social engineering, der foregår med stemmen, hvor angriberen udgiver sig for at være banken, IT-support eller en chef og bruger tonefald, hastværk og et forfalsket nummer til at presse målet til at handle med det samme; nyere varianter bruger en computerskabt kopi af en kendt persons stemme."},"plain":{"en":"Like a smooth-talking salesman on the phone who never lets you pause long enough to think.","da":"Som en glat sælger i telefonen, der aldrig giver dig pause nok til at tænke dig om."},"inPractice":{"en":"A clerk at a pension fund gets a call from “the IT help desk” about a problem with her account, and is talked into reading out the MFA code that has just arrived on her phone.","da":"En medarbejder i en pensionskasse bliver ringet op af “IT-supporten” om et problem med hendes konto og bliver snakket til at læse den MFA-kode op, der lige er kommet på hendes telefon."},"whyItMatters":{"en":"A live voice builds trust and pressure faster than any email, and a code read out loud can get an attacker past MFA.","da":"En levende stemme skaber tillid og pres hurtigere end nogen mail, og en kode, der læses højt, kan få en angriber forbi MFA."}},"deepDive":{"en":"Vishing exploits the fact that caller ID was designed as a convenience, not as authentication. On SIP-based VoIP the calling number is simply a field the originating system fills in, and it crosses operator boundaries largely unverified, so a caller can present the number of a bank, a police station or the target's own IT department. The US response is STIR/SHAKEN, built on RFC 8224 (authenticated identity in SIP), RFC 8225 (PASSporT tokens) and RFC 8226 (certificates for telephone numbers): the originating carrier signs the call with an attestation level of A (full), B (partial) or C (gateway), and the terminating carrier verifies it. The FCC required large US carriers to implement it on IP networks by 30 June 2021. It does not protect calls that transit legacy TDM links or originate abroad, and it proves only which carrier vouched for the number, not who is speaking.\n\nThree attack patterns dominate against organisations. First, MFA bypass: the caller poses as IT support or the bank's fraud team and gets the victim to read out a one-time code or approve a push prompt while the attacker logs in, sometimes after flooding the victim with prompts (MFA fatigue); number matching in authenticator apps, enforced by Microsoft Authenticator since 2023, weakens but does not eliminate this. Second, help-desk attacks run the other way: the attacker calls the organisation's own service desk posing as an employee and asks for a password reset or new MFA registration, the reported entry vector in the 2023 MGM Resorts compromise attributed to Scattered Spider. Third, callback phishing (telephone-oriented attack delivery), popularised by the BazarCall campaigns in 2021, sends an email about a fake subscription charge with no link at all, only a phone number; the call centre then talks the victim into installing remote-access software.\n\nVoice cloning adds identity spoofing to number spoofing. Short samples of public audio are enough for current models to produce a convincing imitation; cases range from the widely reported 2019 fraud against a UK energy company using a cloned executive voice to the 2024 case in which an Arup employee in Hong Kong transferred about HK$200 million after a video conference in which all other participants were deepfakes.\n\nBecause the channel itself cannot be trusted, defences are procedural: never act on an inbound call's identity claim, hang up and call back on a number from the directory or the back of the card, never read out codes, and give help desks verification methods that a researched caller cannot pass, such as manager confirmation through a separate channel or in-person or video identity checks against an ID document. Phishing-resistant MFA removes the codes worth stealing. Vishing differs from smishing by its live, adaptive pressure, and it is one of the most common delivery channels for pretexting.","da":"Vishing udnytter, at nummervisning blev designet som en bekvemmelighed og ikke som godkendelse. På SIP-baseret VoIP er det kaldende nummer blot et felt, som det afsendende system udfylder, og det krydser operatørgrænser stort set uverificeret, så den, der ringer, kan vise nummeret for en bank, en politistation eller målets egen IT-afdeling. Det amerikanske svar er STIR/SHAKEN, bygget på RFC 8224 (godkendt identitet i SIP), RFC 8225 (PASSporT-tokens) og RFC 8226 (certifikater for telefonnumre): Den afsendende operatør signerer opkaldet med et attesteringsniveau A (fuld), B (delvis) eller C (gateway), og den modtagende operatør verificerer det. FCC krævede, at store amerikanske operatører indførte det på IP-net senest 30. juni 2021. Det beskytter ikke opkald, der går via ældre TDM-forbindelser eller stammer fra udlandet, og det beviser kun, hvilken operatør der har stået inde for nummeret, ikke hvem der taler.\n\nTre angrebsmønstre dominerer mod organisationer. Det første er omgåelse af MFA: Den, der ringer, udgiver sig for at være IT-support eller bankens svindelafdeling og får offeret til at læse en engangskode op eller godkende en push-anmodning, mens angriberen logger ind, nogle gange efter at have bombarderet offeret med anmodninger (MFA-træthed); nummermatchning i godkendelsesapps, som Microsoft Authenticator har håndhævet siden 2023, svækker angrebet, men fjerner det ikke. Det andet er angreb på servicedesken, der går den modsatte vej: Angriberen ringer til organisationens egen servicedesk som en medarbejder og beder om nulstilling af adgangskode eller ny MFA-registrering, hvilket var den rapporterede indgang i kompromitteringen af MGM Resorts i 2023, der tilskrives Scattered Spider. Det tredje er callback-phishing (telephone-oriented attack delivery), kendt fra BazarCall-kampagnerne i 2021, hvor en mail om et falsk abonnementstræk ikke indeholder noget link, kun et telefonnummer; callcentret snakker derefter offeret til at installere fjernadgangssoftware.\n\nStemmekloning lægger identitetsforfalskning oven på nummerforfalskning. Korte klip af offentlig lyd er nok til, at nutidens modeller kan lave en overbevisende efterligning, og sagerne spænder fra den meget omtalte svindel i 2019 mod et britisk energiselskab med en klonet direktørstemme til sagen fra 2024, hvor en medarbejder hos Arup i Hongkong overførte omkring 200 mio. HK$ efter et videomøde, hvor alle de andre deltagere var deepfakes.\n\nFordi kanalen i sig selv ikke kan stoles på, er forsvaret procesmæssigt: Handl aldrig på et indgående opkalds påstand om identitet, læg på og ring tilbage på et nummer fra telefonbogen eller bagsiden af kortet, læs aldrig koder op, og giv servicedesken verifikationsmetoder, som en velforberedt opringer ikke kan klare, fx bekræftelse fra lederen via en separat kanal eller identitetskontrol ved fremmøde eller på video mod et ID-dokument. Phishing-resistent MFA fjerner de koder, der er værd at stjæle. Vishing adskiller sig fra smishing ved sit levende, tilpasningsdygtige pres, og det er en af de mest almindelige kanaler til pretexting."},"edges":[{"type":"kind-of","to":"security/social-engineering","confidence":"high","strength":"normal"},{"type":"causes","to":"security/data-breach","why":{"en":"Codes and details handed over on the phone let the caller log in and reach data as if they were the victim.","da":"Koder og oplysninger, der udleveres i telefonen, lader den, der ringer, logge ind og få adgang til data, som om vedkommende var offeret."},"confidence":"medium","strength":"normal"}],"depth":0,"sources":[{"title":"NIST Glossary - Vishing","url":"https://csrc.nist.gov/glossary/term/vishing","tier":"standard","publisher":"NIST"},{"title":"MITRE ATT&CK - T1566.004 Phishing, Spearphishing Voice","url":"https://attack.mitre.org/techniques/T1566/004/","tier":"reference","publisher":"MITRE"}],"draft":true}