What is Vishing?
Vishing is a phone fraud that uses social engineering to exploit human psychology rather than technical systems, and is a method that has been around for decades. Historically, the technique of phishing for credentials has been extremely successful and has been shown to evade even the most advanced security systems and defensive technologies. What’s more, as businesses have been challenged with the rapid migration to remote working, hackers have ramped up their efforts to take advantage of the lack of in-person verification.
In comparison to the infamous email scams that are rife, cybercriminals have recently revived the more traditional technique of vishing (voice phishing by phone). Whilst many may think they will spot the old-school scam, hackers have improved their techniques to avoid suspicion and unfortunately, increased their chances of success. The threat of vishing has grown to such a scale that in August 2020, the CISA and FBI issued a joint security advisory warning about the ongoing wave of attacks. With an increase in all types of fraud to misuse information, vishing must be on every organisation’s radar.
Vishing Explained
In simple terms, vishing is the fraudulent practice of extracting sensitive information over the phone. Cybercriminals will spend time compiling information on targets from public profiles on social media platforms to enable them to create convincing personas. They will then pretend to be an authority figure which includes simple telemarketing and technical support frauds, as well as implementing more complex government and financial institution impersonations. By calling employees at home and combining one-on-one phone calls with credible-looking phishing sites, hackers can collect login credentials for corporate networks and then later monetise the information by selling the access to other groups.
While vishing is often the work of independent hackers or small cybercriminal groups, some government-backed groups now integrate vishing into their arsenal. Vishing offers a more controlled tactic to ensure the success of the initial phishing phase. Some notable recent examples include:
- The Ritz London – the five-star London-based hotel was targeted in August 2020 with a convincing phone-based identity fraud attack within its food and beverage reservation system. Personal data was compromised, albeit not credit card details or payment information. However, the guest’s details were then used in follow-on fraud attempts. The hackers called up diners on a spoofed number to enquire about their restaurant bookings in the hope of obtaining their card details.
- Twitter – the leading social networking site was victim to a phone spear-phishing attack in July 2020. The hackers called up employees at Twitter and used failed identities to trick them into giving up credentials to an internal company tool. Using this, they were able to reset the passwords and two-factor authentication codes of target user accounts. The 130 targeted accounts include CEOs, celebrities, and politicians, which were then used to share bitcoin spam with their followers.
- GoDaddy – the well-known web hosting company fell victim to a vishing attempt in November 2020. Hackers managed to convince GoDaddy employees to hand over control to a couple of cryptocurrency trading websites. Email traffic was redirected without authorisation, and user funds had to be frozen for 24 hours. No personal information was reported to have been stolen during the attack, but it is yet another example of vishing being used to trick companies with malicious intent.
How do Vishing scams work?
As with all phishing attacks, vishing preys on human emotions, commonly greed or fear, to convince victims to disclose sensitive information. However, they are particularly successful due to our innate nature to trust human voices. This puts elderly or technophobic people at increased risk as they have less knowledge and experience of this type of scam. Having said that, everyone is still at risk.
While some vishing attacks work by scammers using auto-dialers to call as many people as possible until someone answers, they are often extremely targeted. To make them successful, many vishing scams will leverage mass scraping of public profiles on social media platforms and publicly available background check services to gain as much information as possible. With the information gathered, scammers effectively impersonate trusted figures. Additionally, the use of spoofed caller IDs and supporting phishing web pages that look like the targeted companies or spoofed websites can seem incredibly convincing.
Once a hacker obtains information, they may directly use it to steal money, impersonate a victim to further penetrate a network, or sell the information for financial reward. After this successful attack, the scammer will usually disappear. Hence cybercriminals take many steps to hide their identities, which makes finding and prosecuting them is highly difficult.
How to Protect Your Business from Vishing
Human error is one of the major barriers to a successful cybersecurity strategy. A simple mistake by an employee can lead to serious consequences. As vishing attacks are targeted directly at people, it stands to reason that prevention should be observed from the same perspective. This involves educating and fostering a healthy level of suspicion so that individuals are aware of how to identify and prevent phishing attempts. Cyber Security training should ensure employees are:
- Cautious of unknown callers – if the caller is unfamiliar, employees should ask for the caller’s name, who they work for, and all applicable details. Employees should never give out any information and should cross-check all information.
- Vigilant at all times – it is difficult to always be on guard, but that is what vishing relies on. Employees should be aware not to fall for calls that attempt to play on their emotions.
- Unreliant on caller ID – if employees automatically trust caller IDs, it makes it easier for spoofed numbers to trick them. While nuisance calls may be avoided, scammers can still get through.
- Unwilling to give details – unless a request is undeniably from an official channel, employees should never share login information, provide account data or identifiable information, or change logins or passwords over the phone.
- Inclined to double-check – urgent requests for financial information should not be immediately trusted. Employees should always take time to double-check authenticity and ideally, an approval process should be firmly in place.
- Aware of acceptable requesters – as well as having agreed channels for sharing information, employees should be aware of a list of names of those who may request certain information.
- Familiar with the reporting process – employees should make a point to record suspected calls or fraud attempts so that further attempts can hopefully be prevented.
How Protected is Your Organisation?
When it comes to vishing or phishing attempts, the only real protection the end-user has are their wits and suspicion that something is not right. This makes education and awareness a vital part of every organisation’s cybersecurity efforts. To find out how well your business is protected and what you can do to secure your information, get in touch for a cybersecurity maturity assessment.
see our
Related resources
Phishing attacks have increased dramatically over the last few years, with the global pandemic escalating the situation further. Cybercriminals take advantage of insecurities and fear and play on human nature to trick and deceive. In fact, according to the OAIC, phishing attacks that involved compromised credentials accounted for 30% of all cyber incidents in the first half of 2021. And human error formed a major source of these breaches. Unfortunately, due to the clever social engineering tactics used by cybercriminals, technical filters alone aren’t sufficient to protect against phishing.
Cybersecurity should be front of mind for every organisation, especially in the wake of the current global pandemic. Our ways of working have changed immensely, with a surge in the volume of remote workers using different networks, devices, and platforms. Meanwhile, our businesses are using cloud computing and IoT technologies to facilitate new ways of working, reduce costs, and improve performance. The result is that the attack surface has increased, and with that comes an increase in the volume of cyber threats.
There are images of extensive, verbose documents, complex definitions, and eye-watering Excel sheets when the term GRC is mentioned. For the past two decades, GRC has been central to core business processes across many organisations at both ends of the enterprise spectrum, as well as in the small-to-medium business space in recent times.
But the world has moved on; organisations are forced to embrace digital disruption and agility if they haven’t done so whole-heartedly. And this very disruption is positioning GRC to become less-than-ideal to solve the challenges that said disruption brings with it.
Australia’s annual Cyber Week is due to return on 25-29 October 2021. The event combines virtual and in-person sessions, giving cybersecurity and business professionals a chance to network, share knowledge and build shared resilience. By debating topical issues and highlighting threats and solutions, the event fosters a greater understanding of cybersecurity in Australia.
Mimecast recently released its State of Email Security Report for 2021. The fifth edition of its annual report used interviews with over twelve hundred of information technology and cybersecurity professionals across the globe to gather vital cybersecurity insights. The report offers an insight into the latest email threats along with advice on how to build cyber resilience and mitigate the risks of email-borne attacks.
Secure Access Service Edge, better known as SASE (pronounced sassy – yes that is right) was one of the new security terms on the block in 2019. But it’s actually been around for some time, just without its official moniker. It is expected that by 2024, at least 40% of enterprises will have strategies in place to adopt SASE, according to Gartner.
In this post, Cloud Security Engineer, Will Michail takes a look at why its popularity is increasing now, what the term means and how vendors and organisations are utilising it to enable digital transformation.
We're Here To Help