SimSmsBox Quick answer: Vishing is voice phishing — a scam phone call (or voicemail) that pressures you into revealing a password, a verification code, or payment details, or into installing software. It’s the spoken cousin of smishing, and it works because a live voice feels urgent and authoritative. The defense never changes: hang up and call back on an official number, and never read out a code to anyone who called you.
A convincing voice can do what a suspicious link can’t: it rushes you, answers your doubts in real time, and makes you feel rude for saying no. That’s exactly why phone scams still work. Understanding the script strips away the pressure.
1. How a vishing call works
Vishing follows the same social-engineering arc as other phishing, just over the phone:
- Pretext. The caller claims to be your bank’s fraud team, a tax office, tech support, or a delivery service.
- Urgency. “Your account has been compromised,” “a payment is pending,” “legal action starts today.”
- The ask. Read back a code you just received, confirm your password, move money to a “safe account,” or install a remote-access app.
- Control. They keep you on the line so you can’t independently verify.
The number on your screen means nothing — attackers use caller ID spoofing to look like your bank.
2. Common vishing scripts
| Pretext | The real goal |
|---|---|
| ”Bank fraud dept — confirm this charge” | Get your password or code |
| ”We detected a virus on your PC” | Install remote-access malware |
| ”Read me the code we just sent” | Complete their login to your account |
| ”Move funds to a safe account” | Direct bank transfer to the scammer |
That third one is the crossover with OTP bot scams: the attacker already has your password and just needs you to speak the code aloud.
3. How to stay safe
- Hang up on urgency. Real institutions don’t demand codes or transfers on an unsolicited call.
- Call back independently. Use the number on your card or the official website, not one the caller gives you.
- Never say a verification code out loud. No legitimate agent will ever ask for it.
- Don’t install anything a caller asks you to, and never grant remote access.
- Slow down. Pressure to act “right now” is the tell.
4. Vishing vs smishing vs spoofing
- Vishing: the scam arrives as a voice call.
- Smishing: the same trick delivered by text message.
- Spoofing: the technique that fakes the caller ID both often rely on.
Different channel, identical goal: get you to hand over access.
5. What this means for verification codes
A verification code is the prize in most vishing calls. Whether the code reaches a SIM or you receive it online, the rule is absolute: a code is for you to type into the app you’re logging into — never to speak to a caller. If someone on the phone needs your code, they are not who they say they are. An unexpected code arriving right as “your bank” calls is the clearest sign an attacker already has your password and is trying to finish the job.
FAQ
Q: How is vishing different from a normal scam call? Vishing specifically uses social engineering to extract credentials, codes, or payments, often impersonating a trusted institution — versus generic spam or robocalls.
Q: They knew my name and last four digits — was it really my bank? Not necessarily. Scammers buy leaked data to sound legitimate. Verify by calling the official number yourself.
Q: Is it safe to just answer an unknown call? Answering is usually harmless; the risk is in acting on what you’re told. Never share codes, passwords, or payments based on an inbound call.
Takeaway
Vishing is phishing by phone: a pressuring voice, a fake caller ID, and a request for your code, password, or money. Because the attack is on your reaction, the defense is simple — hang up, call back on a number you trust, and never speak a verification code to anyone who called you.