SecurityRingBook a Demo

Glossary

What is vishing? Voice phishing explained

Voice phishing: a phone call or voice message that impersonates someone trusted to get information, money or access. The FBI warns that attackers increasingly use AI-generated voices.

How it works

CISA describes vishing as the social engineering approach that uses voice communication, and notes that internet calling makes it easy to spoof caller ID. Microsoft describes vishing as callers luring targets into revealing sensitive information under false pretences, or into carrying out actions on the caller’s behalf.

A real example

From mid-April 2024, Microsoft Threat Intelligence saw the group it tracks as Storm-1811 flood employees’ inboxes with subscription spam, then phone them posing as IT support and offering to fix it. Victims were talked into opening Quick Assist and entering a code, which handed the caller a remote session. Microsoft linked the activity to Black Basta ransomware. In May 2025 the FBI warned that criminals were sending AI-generated voice messages that claimed to come from senior US officials.

How to train for it

  • Hang up and call back on a number you already know, never one the caller gives you.
  • Treat unexpected “IT support” calls that ask for remote access or a code as suspicious.
  • Report the call, even if you already acted on it.

SecurityRing’s voice-call simulations are coming soon and are not available today. Live email simulations and lessons can cover help-desk pretexts now.

Sources

Every clause, incident and figure above comes from these official or original sources.

  1. CISAAvoiding Social Engineering and Phishing AttacksAccessed 17 October 2026.
  2. FBI Internet Crime Complaint CenterSenior US Officials Impersonated in Malicious Messaging Campaign (PSA I-051525-PSA)Published 15 May 2025 · Accessed 17 October 2026.
  3. Microsoft Threat IntelligenceThreat actors misusing Quick Assist in social engineering attacks leading to ransomwarePublished 15 May 2024 · Accessed 17 October 2026.