Vishing
Also called voice phishing, phone scam fraud
Vishing, or voice phishing, is fraud carried out by phone. A criminal calls or leaves a voicemail posing as a bank, the police, a tax authority or a trusted company, and persuades the victim to hand over security details or send money. It is a leading cause of authorised push payment fraud and account takeover.
How it works
The caller often spoofs a real phone number so the call appears to come from the victim's bank. They create urgency, such as a fraud alert or a tax debt, and either ask for one-time passcodes and card details or tell the victim to move money to a safe account the fraudster controls. Voice cloning and earlier data breaches make the call more convincing, and a text message often comes first to set the scene.
Banks fight vishing at the point of payment. Monitoring looks for signs of coaching: a first payment to a new payee, an unusually large transfer, hesitant typing, or an active phone call during an app session. Flagged payments meet warnings tailored to the scam type, a delay or a call from the fraud team. Firms also tell customers they will never ask them to move money or share codes over the phone.
The rules
Requires firms to reimburse consumers tricked into sending payments to fraudsters, including through phone scams, with the cost split equally between sending and receiving firms.
Payment service providers sending and receiving Faster PaymentsBans impersonating government agencies and businesses, including by phone call, and lets the FTC seek civil penalties and consumer redress in court.
Any person impersonating a government body or business in commerceCommon questions
What is the difference between vishing and phishing?
Phishing uses email to trick people into sharing details or clicking links. Vishing uses phone calls or voicemail, and smishing uses text messages. Many scams combine all three.
Are banks liable for vishing losses?
In the UK, consumers who are tricked into sending a Faster Payment are covered by the APP reimbursement rules, subject to exceptions such as gross negligence. Losses from payments the customer did not authorise fall under separate unauthorised payment rules.
How do banks detect vishing?
Banks use behavioural analytics, payee and amount risk scoring, and signals such as an active phone call during an app session. Flagged payments get targeted warnings or a call from the fraud team before release.
