Vishing: How Voice Phishing Calls Work and How to Stop Them

Vishing, short for voice phishing, is a scam carried out by phone call or voicemail. The caller pretends to be someone you trust, such as your bank’s fraud department, a tech company or a government agency, and tries to get you to share a one-time code, a password or card details, or to move money. The safest response to any unexpected call asking for those things is to hang up and call the organization back on a number you look up yourself.

Vishing works because a live voice feels more trustworthy than a text or email, and because the caller can react to your hesitation in real time. People who fall for it are not careless. The callers are practiced, they often already know some of your details, and the whole call is designed to keep you from stopping to think.

What vishing is and how it differs from other phishing

Phishing is the general term for tricking someone into handing over information or money by pretending to be a trusted source. The channel gives each version its name:

Type	Channel	Typical hook
Phishing	Email	A fake invoice, account warning or login page. See our guide on how to spot a phishing email.
Smishing	Text message	A fake delivery, toll or bank alert with a link. See our smishing guide.
Vishing	Phone call or voicemail	A caller claiming your account is compromised or you owe money.
Quishing	QR code	A code that leads to a fake payment or login page.

These often combine. A scam text might tell you to call a number, or a caller might send you a text “to verify” who they are. Treat the whole chain as one scam.

Common vishing scams

The fake bank fraud department

This is one of the most common versions. A caller says they’re from your bank’s fraud team and that they’ve spotted a suspicious charge. The caller ID may even show your bank’s name or number. They then ask you to “confirm your identity” by reading back a code that was just texted to you, or they tell you your account is at risk and you need to move money to a “safe account” or send it through a payment app to “reverse” the fraud. The code is really the key to your account, and the safe account belongs to the scammer. Our Zelle scams guide covers the payment-app version in detail.

Government and law enforcement impersonation

Callers claim to be from the IRS, the Social Security Administration, Medicare, a court or the police. They say you owe money, your benefits are suspended or there’s a warrant for your arrest, and that paying now will make it go away. Real agencies don’t demand immediate payment by gift card, crypto or wire over the phone. Our guides to IRS scams and jury duty scams go deeper on these.

Tech support and account security calls

A caller says your computer has a virus, your Amazon or Apple account has been used, or a subscription is about to renew. The goal is usually to get you to install remote access software or pay for a fake fix or refund. The Geek Squad scam and Microsoft scam follow this pattern.

AI voice cloning and “family emergency” calls

Some callers use AI tools to copy the voice of a relative from short clips posted online, then call with an urgent story: an accident, an arrest, a trip gone wrong. The voice may sound right even though the person isn’t on the line. Our guide to AI voice cloning scams explains how to check a call like this, and grandparent scams covers the older version that relies on a bad line and a convincing story.

How caller ID spoofing works

Caller ID is not proof of who is calling. Scammers can use internet calling tools to make almost any number or name appear on your screen, including your bank’s real customer service line or a local number that looks familiar. This is called spoofing.

That’s why “but it showed my bank’s number” is not a reason to trust a call. The only reliable check is to end the call and dial the number yourself from the back of your card, your statement or the organization’s official website. If the problem is real, the real organization will be able to see it.

Warning signs of a vishing call

• You didn’t expect the call, and it’s about a problem you didn’t know you had.
• Urgency or fear. Your account will be frozen, you’ll be arrested, the money will be gone within the hour.
• A request for a code. Banks and apps send one-time codes so you can prove it’s you. A legitimate caller has no reason to ask you to read one back.
• A request to move money to protect it, to a “safe account”, a new payee, a payment app or a crypto ATM.
• Unusual payment methods such as gift cards, crypto, wire transfers or cash handed to a courier.
• Pressure to stay on the line or keep the call secret, even from your bank branch or family.
• Remote access requests to install an app so they can “fix” or “check” something.
• They know some of your details, like your name, address or the last digits of your card. This information is often bought from data leaks and doesn’t prove anything.

What to do right now if you think you got a vishing call

1. End the call. You don’t need to be polite or explain. Saying you’ll call the bank yourself is enough.
2. Call the real organization. Use the number on your card, your statement or the official website or app. Tell them what happened and ask them to check for unusual activity.
3. If you shared a one-time code or password, change that password straight away, starting with your email and banking, and sign out of other devices. Turn on two-factor authentication if it wasn’t on. Our my account was hacked guide walks through this account by account.
4. If you shared card details, ask your card issuer to freeze or replace the card.
5. If you installed remote access software, disconnect the device from the internet, uninstall the software, run a security scan and change passwords from a different, trusted device.
6. If you shared your Social Security number, consider a credit freeze with the three credit bureaus and see what to do if your identity is stolen.
7. Write down what happened: the time, the number shown, what they said and what you shared or paid. Screenshot your call log.

When you call your bank back, be specific:

I received a call from someone claiming to be your fraud department. I shared a verification code before I realized it might be a scam. Can you check my account for any changes or payments in the last hour and secure it?

Where to report a vishing call

• ReportFraud.ftc.gov for almost any scam call, whether or not you lost money.
• The FBI’s IC3 (ic3.gov) if the scam involved online payments, crypto or a larger loss.
• The FCC takes complaints about unwanted calls, robocalls and caller ID spoofing through its consumer complaint center.
• IdentityTheft.gov if the caller got enough information to open accounts or file taxes in your name.
• The organization that was impersonated, through its official website or the number on your card. Banks want to know when their name is being used.
• Your phone’s built-in tools. Most phones and carriers let you block and report a number as spam.

For the full list, including routes outside the US, see our guide on how to report a scammer.

Getting money back after a vishing scam

How you paid decides what’s possible, and speed matters in every case.

• Card payments can usually be disputed with your card issuer, especially if you report quickly.
• Bank transfers should be reported as fraud right away. Your bank may be able to recall the money if it hasn’t left the receiving account.
• Payment apps such as Zelle, Venmo or Cash App vary. Payments you were tricked into sending yourself are often harder to recover than unauthorized ones, but report them to the app and your bank anyway.
• Gift cards, wire transfers and crypto are often hard or impossible to reverse. Contact the gift card company or transfer service immediately in case the funds can be frozen.

After a scam, you may get calls from people offering to recover your money for a fee. That is almost always a second scam. Our guide to recovery scams explains why.

Worked example: the “suspicious charge” call

This is an illustrative scenario, not a real person. Dana gets a call on a Tuesday evening. Her screen shows her bank’s name. A calm, professional voice says a charge for an electronics purchase in another state has been flagged and asks whether she made it. She didn’t. The caller says they’ll block it, but first she needs to confirm her identity with a code they’re texting her.

The code arrives, and the text says not to share it with anyone. That line makes her pause. She tells the caller she’ll call the bank back, hangs up and dials the number on her debit card. The real fraud team finds no flagged charge, but they do see a recent attempt to reset her online banking password. They lock the account and walk her through a new password. She reports the call at ReportFraud.ftc.gov and adds the number to her phone’s block list.

How to protect yourself from vishing

• Make “I’ll call you back” your default for any unexpected call about money, accounts or legal trouble.
• Save your bank’s real number in your contacts from the back of your card, so you’re never searching for it under pressure.
• Agree on a family code word for emergencies, so a cloned voice can be tested with a question only the real person could answer.
• Let unknown numbers go to voicemail. Real callers leave messages; you can then check them independently.
• Use your carrier’s and phone’s spam call filters. They won’t catch everything but they reduce the volume.
• Reduce what’s public about you. Scammers use your address, relatives’ names and phone number to sound convincing. Removing yourself from people search sites makes that harder.

If scammers are calling people in your name

Sometimes the problem runs the other way: people report that “you” or your business called them, because a scammer spoofed your number or used your company’s name. Put a short notice on your website and social profiles explaining how you do and don’t contact customers, report the impersonation, and see our guide on what to do if someone is impersonating you online. If angry reviews or warning posts start appearing when people search for you, our personal reputation management team can help assess what can be corrected.

Common mistakes to avoid

• Trusting caller ID. A familiar name or number on the screen proves nothing.
• Calling back the number in the voicemail. Use a number you find yourself.
• Reading out a code “just to verify”. That code is usually the last step the scammer needs.
• Waiting out of embarrassment. Banks handle these calls every day, and the sooner they know, the more they can do.

Frequently asked questions

What is vishing?

Vishing is voice phishing: a scam phone call or voicemail where someone pretends to be a bank, company or government agency to get your personal details, account codes or money.

Can a scammer make my bank's number show up on caller ID?

Yes. Caller ID spoofing lets scammers display almost any number or name, including your bank’s real one. Hang up and call the number on your card to check.

What should I do if I gave a scammer a verification code?

Call your bank or the account provider right away using an official number, change the password for that account, sign out of other devices and turn on two-factor authentication. Then report the call at ReportFraud.ftc.gov.

Will my bank ever call and ask me to move money to a safe account?

Banks say they won’t ask you to move money to protect it. A request to transfer funds to a “safe” or new account is a strong sign of a scam.

Is it safe to answer calls from unknown numbers?

Answering usually isn’t the danger; what you say and do next is. If you’re unsure, let it go to voicemail and never share codes, passwords or payment details with an unexpected caller.