Vishing, or voice phishing, is social engineering conducted over the phone. The caller impersonates a bank, a retailer’s support line, a government agency, or the victim’s own employer to extract credentials, payment details, or one-time passcodes. Voice cloning has made the impersonation dramatically more convincing.
How Vishing Works
A typical play: the victim receives a call, often with a spoofed caller ID, warning of fraud on their account. The “agent” walks them through security steps that are actually the attack, reading back a one-time passcode, confirming card details, or installing remote access software. Vishing frequently pairs with other channels, following up a smishing text or phishing email to add credibility. Visa’s Spring 2026 threats report identified nearly $1 billion in scam-related activity in the second half of 2025, with criminals increasingly targeting people rather than technology.
Why It Matters for Commerce Brands
Vishing harvests exactly what defeats account security: one-time passcodes and verified answers. A shopper talked out of an OTP hands over the second factor protecting their store account, and the resulting account takeover looks fully authenticated. Brands can help by telling customers plainly what their support team will never ask for by phone, and by treating OTP-verified sessions with unusual behavior as still worth scoring.
How Wyllo Helps
Authentication can be socially engineered; behavior is harder to fake. Wyllo scores what the session does, not just how it logged in, so a passcode-verified takeover still trips intent signals. Wyllo Claim and Policy Abuse Prevention catches the account abuse, and Wyllo CX Support gives agents the risk context to spot a manipulated conversation in progress.
Frequently Asked Questions
What makes vishing effective against OTP-based security?
The passcode is only as secure as the person holding it. A convincing caller who triggers a real OTP and asks the victim to read it back has converted strong authentication into a formality.
How has AI changed vishing?
Voice cloning lets attackers imitate specific people, including executives and family members, from short audio samples, and AI handles the conversation at scale. The old advice to listen for awkward callers no longer holds; verification procedures matter more than instincts.
