How vishing works
The attacker researches the target, spoofs a trusted number and creates urgency, for example a fraud alert or a locked account. The caller then asks the victim to read out a code, install remote access software or approve a transfer.
Vishing is often combined with other tactics: a phishing email prompts a callback, or a caller asks the victim to approve an authentication prompt that the attacker has just triggered with stolen credentials. Artificial voice cloning has made impersonation more convincing, because a call can now sound like a known colleague or executive, so voice recognition alone is not reliable proof of identity.
Why it matters for Canadian organizations
Phone calls bypass email filters, and help desks are a favoured target because they can reset passwords or multi-factor settings. A single convincing call can hand attackers valid access.
The Canadian Anti-Fraud Centre regularly warns about impersonation scams, and similar tactics are used against businesses. Compromised accounts can lead to breaches of personal information that trigger obligations under PIPEDA and Law 25. Because these attacks happen live, a single moment of pressure decides the outcome, which is why staff need an easy, pre-approved way to pause, verify and escalate without feeling rude.
How to defend against it
Establish strict identity verification for help desk and finance requests, such as callbacks to known numbers and manager approval for resets. Never share one-time codes or approve unexpected prompts.
Train staff with vishing exercises, tell them real IT staff will never ask for passwords, and make reporting easy. Use phishing-resistant multi-factor authentication to reduce what a stolen code can achieve. Record and review suspicious calls reported by employees, share examples internally, and update procedures promptly whenever attackers change their scripts.
Frequently asked questions
What is the difference between vishing and phishing?
Phishing usually arrives by email or text, while vishing happens over a voice call. Both are social engineering and aim to obtain credentials, money or access, but vishing relies on real-time conversation and pressure. Both exploit trust and urgency.
How can I tell a vishing call from a real one?
Be suspicious of unexpected calls that create urgency, ask for passwords or codes, or request remote access. Hang up and call back using a number from the organization's official website or your records. Verification is always the safest habit.
Can caller ID be trusted?
No. Caller ID can be spoofed to show a bank, agency or internal extension. A familiar number or name does not prove the caller's identity, so verify requests through an independent channel. Always verify through an independent channel.
Related service: Phishing simulation