📞 Vishing & Impersonation
When the phishing call comes from a real-sounding human voice⏱ ~2 min
Vishing — Voice Phishing
Vishing is a form of phishing that occurs over voice communication, usually phone calls. Attackers impersonate trusted entities — your bank, tech support, a government agency — and persuade victims to reveal sensitive information over the phone.
Impersonation
Attackers pretend to be someone else — online or in person — to gain trust and manipulate the target into disclosing confidential information or taking specific actions. This can be as simple as a phone call claiming to be IT support, or as elaborate as physically showing up wearing a uniform to gain building access (this overlaps with 'pretexting' and physical social engineering).
| Impersonation Scenario | What They're After | Red Flag |
|---|---|---|
| 'IT support' calling about a 'security issue' | Remote access software install, password reset | Legitimate IT rarely cold-calls demanding immediate remote access |
| 'Bank fraud department' | Account number, OTP code, card PIN | Banks never ask for your full password or OTP over the phone |
| Delivery driver / contractor at the door | Building access, badge cloning opportunity | No advance notice, no verifiable company ID, vague details |
| 'New employee' asking for a badge swipe ('tailgating') | Physical building access without their own credentials | Always verify identity before holding a door for someone you don't recognize |
Someone calls claiming to be your bank and asks for your OTP code. You should…