Phishing arrives by email; vishing arrives by phone. A live caller or a convincing robocall claims to be your bank, a government agency, or tech support, and talks you into revealing a code, a password, or a payment. The human voice and real-time pressure make it disarmingly effective. Our GetMyPassword team explains what vishing is and how to defend against it.
What vishing is
Vishing — short for “voice phishing” — is a scam carried out over a phone call or voicemail. The caller impersonates a trusted organization: your bank’s fraud department, a government office, a tech-support team, or a delivery service. Using a script and often a spoofed caller ID that shows a familiar name or number, they create a believable reason to keep you on the line and extract what they want — a one-time code, your password, card details, or an immediate payment. Some use recorded robocalls that prompt you to “press 1” or call back a number that connects to the scammer.
Common vishing tactics
- A “fraud alert” claiming suspicious activity that you must “verify” right now.
- A request to read back a one-time code just sent to your phone.
- Spoofed caller ID showing your bank’s real name or number.
- Threats of arrest, fines, or account suspension to create panic.
- A demand to move money “to a safe account” or pay by gift card.
Why a voice is persuasive
A live conversation removes the time to think that a written message allows. The caller can respond to your hesitation, sound authoritative, and apply steady pressure, while spoofed caller ID lends false legitimacy. The single most important thing to know is that a one-time code is for you alone — no real bank or company will ever call and ask you to read it back. Likewise, no legitimate institution asks you to move money to a “safe account” or pay a debt in gift cards. Those requests define the scam.
Caller ID can be faked and a calm voice can be rehearsed. A one-time code is yours alone — anyone on the phone asking you to read it back is, by that request, a scammer.
How to protect yourself
If a call pressures you about money or security, hang up and call the organization back on a number you look up yourself, never one the caller gives you. Never share one-time codes, passwords, or card details on an inbound call, and ignore “press 1” robocalls. Let unknown numbers go to voicemail. Protect your accounts with two-factor authentication and a unique password from our password generator, so that even a slip on the phone does not hand over everything.
Frequently asked questions
What is vishing?
Vishing is voice phishing — a scam by phone call or voicemail where someone impersonates your bank, a government agency, or support to extract a one-time code, password, card details, or payment, often using a spoofed caller ID.
How is vishing different from phishing?
Phishing typically uses email or text with malicious links, while vishing uses a phone call or voicemail. The live voice and real-time pressure, plus spoofed caller ID, make vishing especially persuasive.
How do I protect myself from vishing?
Hang up and call back on a number you look up yourself, never share one-time codes or passwords on an inbound call, ignore “press 1” robocalls, and use two-factor authentication with unique passwords so a single slip cannot unlock everything.