{"id":18501,"date":"2021-06-30T03:47:59","date_gmt":"2021-06-30T07:47:59","guid":{"rendered":"https:\/\/me-en.kaspersky.com\/blog\/how-to-protect-from-vishing\/18501\/"},"modified":"2021-09-24T15:45:33","modified_gmt":"2021-09-24T11:45:33","slug":"how-to-protect-from-vishing","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/how-to-protect-from-vishing\/18501\/","title":{"rendered":"Phishing returns to its roots"},"content":{"rendered":"<p>Between tech support requesting access to your computer, concerned tax services specialists demanding payments, medical equipment suppliers \u201creturning your call,\u201d and many more \u2014 none legitimate \u2014 it\u2019s a wonder anyone even answers their phone anymore. You\u2019d be hard-pressed to find someone who hasn\u2019t experienced some form of phone scam, although the name for it isn\u2019t as well-known: vishing.<\/p>\n<h2>What is vishing?<\/h2>\n<p>Vishing is short for voice plus phishing (as <a href=\"https:\/\/www.kaspersky.com\/blog\/how-to-protect-from-smishing\/39491\/\" target=\"_blank\" rel=\"noopener nofollow\">smishing is SMS + phishing<\/a>), and, aided by the mass transition to remote work, it has turned the phone into a major weapon of fraud, to the extent that law-enforcement agencies now periodically release <a href=\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2020\/08\/fbi-cisa-vishing.pdf\" target=\"_blank\" rel=\"nofollow noopener\">official announcements<\/a> about the danger.<\/p>\n<p>According to <a href=\"https:\/\/www.ftc.gov\/news-events\/blogs\/data-spotlight\/2019\/07\/government-imposter-scams-top-list-reported-frauds\" target=\"_blank\" rel=\"nofollow noopener\">2019<\/a> data from the US Federal Trade Commission, only 6% of scam calls ended in financial loss. Nevertheless, when it happened, the damage was quite significant, with a median value of $960.<\/p>\n<p>Anyone can fall for a scammer\u2019s bait, <a href=\"https:\/\/krebsonsecurity.com\/2018\/10\/voice-phishing-scams-are-getting-more-clever\/\" target=\"_blank\" rel=\"nofollow noopener\">even experts who think they\u2019ve seen it all<\/a>. Many fraudsters are excellent at gaining the confidence of even the most vigilant target.<\/p>\n<p>On the one hand, vishing is more conservative than regular phishing, because the telephone itself is an older means of communication. On the other hand, <a href=\"https:\/\/www.statista.com\/statistics\/273550\/data-breaches-recorded-in-the-united-states-by-number-of-breaches-and-records-exposed\/\" target=\"_blank\" rel=\"nofollow noopener\">massive data leaks<\/a> in the digital age have lent voice scams new power: Never before have scammers been in possession of such volumes of information about almost everyone on the planet. The proliferation of Internet telephony (VoIP) further plays into the hands of cybercriminals, enabling them to manipulate phone numbers and cover their tracks.<\/p>\n<input type=\"hidden\" class=\"category_for_banner\" value=\"kis-trial-banking\">\n<h2>Types of scam calls<\/h2>\n<p>Scammers can say just about anything on a call, but their attempts tend to fall into a few main categories.<\/p>\n<h3>Telemarketing<\/h3>\n<p>Telemarketing fraud tends to involve offers too good to be true and pressure too time-sensitive to end well. Some examples include winning the lottery (bonus points it you didn\u2019t even buy a ticket), a reduced credit card interest rate, and other lucrative offers that are hard to refuse. They tend to have in common the need to make a decision on the spot, plus a small advance payment from you to them.<\/p>\n<p>If you have the time to think about the offer, it\u2019s (usually) clearly fraudulent. If you make the payment, it\u2019ll just go to the scammers, literally rewarding them for their crime and also reinforcing the value of using leaked databases of phone numbers to call and defraud thousands more people.<\/p>\n<h3>Government agency<\/h3>\n<p>One of the most common schemes involves allegedly unpaid or underpaid taxes. A \u201ctax office\u201d initiates the call and provides a choice: Pay the arrears or face a fine. The offer expires soon, after which the fine will increase.<\/p>\n<p>Again, adding time-sensitivity works. Given time to think about how tax agencies communicate with citizens, not to mention their deadline structures, the average citizen could probably figure out that such calls are fraudulent. Faced with a ticking clock and (apparently) a government agency known for strictness, however, adjusts the odds in scammers\u2019 favor.<\/p>\n<h3>Technical support<\/h3>\n<p>For unsolicited tech-support calls, scammers choose large, well-known brands to increase the chances of connecting with an actual user of the product. The caller typically claims to have found an issue with the victim\u2019s computer and asks for login credentials or remote access to their computer.<\/p>\n<p>A more sophisticated scheme involves some preparation, for example, infecting a computer with malware that invokes a pop-up window with a description of the alleged problem and a phone number to call to get it fixed.<\/p>\n<h3>Bank<\/h3>\n<p>The ultimate object of any scam is money, so of course some fraudsters pretend to call from banks. Generally, they claim to be reporting suspicious account activity, which in reality gives them cover to request details such as a CVC\/CVV code or a one-time passcode from a text message. Armed with such details, the fake bank employee can easily clean out an account for real.<\/p>\n<h2>How to recognize scam calls<\/h2>\n<p>We can\u2019t discount the notion that scammers, always on the lookout for more-convincing hooks, might someday learn from fraud\u2019s rich history of tells, but most scams exhibit at least one of several red flags.<\/p>\n<ul>\n<li>If a call supposedly from a bank or government agency comes from a cell number, it\u2019s almost certainly vishing. Double those odds if the phone number is from a different region. However, an official-looking number is no guarantee of a legitimate call; modern technologies allow <a href=\"https:\/\/www.fcc.gov\/spoofing\" target=\"_blank\" rel=\"nofollow noopener\">caller ID spoofing<\/a>.<\/li>\n<li>If a caller tries to extract confidential information, especially in a threatening manner, that too is a sign of vishing. In general, any attempt to find out private information is an indication of fraud: any information a real bank or tax office employee needs about you, they probably already have \u2014 remember, we\u2019re talking about communication <em>they<\/em> initiated, not you.<\/li>\n<li>If someone urges you to make a monetary transaction and cites a deadline, it\u2019s definitely a scam.<\/li>\n<li>If a caller tries to persuade you to install software on your computer to fix some problem they called to tell you about, it will probably end badly for you.<\/li>\n<\/ul>\n<p>Finally, an indirect but still reliable sign of vishing is if the caller gets confused, misspeaks, is hostile, or uses slang expressions. We have nothing against everyday speech, of course, but real operators are generally trained to use professional language.<\/p>\n<h2>How to guard against scam calls<\/h2>\n<p>If you spot at least one of the above red flags, the best option is simply to end the conversation. After that, call the company or organization that supposedly just called you and report the incident \u2014 the more information they collect, the more likely they are to catch, or at least hinder, the fraudsters. Look up the tech or customer support number separately, for example by going to the organization\u2019s official website.<\/p>\n<p>In addition, resolutely avoid installing remote access programs on your computer, however convincing any caller may be, and use a <a href=\"https:\/\/me-en.kaspersky.com\/premium?icid=me-en_bb2022-kdplacehd_acq_ona_smm__onl_b2c_kdaily_lnk_sm-team___kprem___\" target=\"_blank\" rel=\"noopener\">reliable security solution<\/a> that detects dangerous applications in good time and warns you about them.<\/p>\n<input type=\"hidden\" class=\"category_for_banner\" value=\"ksc-trial-generic\">\n","protected":false},"excerpt":{"rendered":"<p>How scammers use voice calls for phishing.<\/p>\n","protected":false},"author":2548,"featured_media":18502,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1486,9],"tags":[2088,80,2495,76,695,131,2465],"class_list":{"0":"post-18501","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-threats","8":"category-tips","9":"tag-tips","10":"tag-fraud","11":"tag-international-day-for-universal-access-to-information","12":"tag-phishing","13":"tag-scam","14":"tag-tips-2","15":"tag-vishing"},"hreflang":[{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/how-to-protect-from-vishing\/18501\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/how-to-protect-from-vishing\/23018\/"},{"hreflang":"ar","url":"https:\/\/me.kaspersky.com\/blog\/how-to-protect-from-vishing\/9230\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/how-to-protect-from-vishing\/24969\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/how-to-protect-from-vishing\/22977\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/how-to-protect-from-vishing\/22224\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/how-to-protect-from-vishing\/25578\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/how-to-protect-from-vishing\/25030\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/how-to-protect-from-vishing\/30932\/"},{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/how-to-protect-from-vishing\/9798\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/how-to-protect-from-vishing\/40410\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/how-to-protect-from-vishing\/17264\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/how-to-protect-from-vishing\/17717\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/how-to-protect-from-vishing\/15002\/"},{"hreflang":"nl","url":"https:\/\/www.kaspersky.nl\/blog\/how-to-protect-from-vishing\/27243\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/how-to-protect-from-vishing\/29392\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/how-to-protect-from-vishing\/29185\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/me-en.kaspersky.com\/blog\/tag\/tips-2\/","name":"tips"},"_links":{"self":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/18501","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/2548"}],"replies":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=18501"}],"version-history":[{"count":1,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/18501\/revisions"}],"predecessor-version":[{"id":18834,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/18501\/revisions\/18834"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/18502"}],"wp:attachment":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=18501"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=18501"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=18501"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}