Vishing

Vishing exploits the fact that caller ID was designed as a convenience, not as authentication. On SIP-based VoIP the calling number is simply a field the originating system fills in, and it crosses operator boundaries largely unverified, so a caller can present the number of a bank, a police station or the target's own IT department. The US response is STIR/SHAKEN, built on RFC 8224 (authenticated identity in SIP), RFC 8225 (PASSporT tokens) and RFC 8226 (certificates for telephone numbers): the originating carrier signs the call with an attestation level of A (full), B (partial) or C (gateway), and the terminating carrier verifies it. The FCC required large US carriers to implement it on IP networks by 30 June 2021. It does not protect calls that transit legacy TDM links or originate abroad, and it proves only which carrier vouched for the number, not who is speaking.

Three attack patterns dominate against organisations. First, MFA bypass: the caller poses as IT support or the bank's fraud team and gets the victim to read out a one-time code or approve a push prompt while the attacker logs in, sometimes after flooding the victim with prompts (MFA fatigue); number matching in authenticator apps, enforced by Microsoft Authenticator since 2023, weakens but does not eliminate this. Second, help-desk attacks run the other way: the attacker calls the organisation's own service desk posing as an employee and asks for a password reset or new MFA registration, the reported entry vector in the 2023 MGM Resorts compromise attributed to Scattered Spider. Third, callback phishing (telephone-oriented attack delivery), popularised by the BazarCall campaigns in 2021, sends an email about a fake subscription charge with no link at all, only a phone number; the call centre then talks the victim into installing remote-access software.

Voice cloning adds identity spoofing to number spoofing. Short samples of public audio are enough for current models to produce a convincing imitation; cases range from the widely reported 2019 fraud against a UK energy company using a cloned executive voice to the 2024 case in which an Arup employee in Hong Kong transferred about HK$200 million after a video conference in which all other participants were deepfakes.

Because the channel itself cannot be trusted, defences are procedural: never act on an inbound call's identity claim, hang up and call back on a number from the directory or the back of the card, never read out codes, and give help desks verification methods that a researched caller cannot pass, such as manager confirmation through a separate channel or in-person or video identity checks against an ID document. Phishing-resistant MFA removes the codes worth stealing. Vishing differs from smishing by its live, adaptive pressure, and it is one of the most common delivery channels for pretexting.