Vishing - Not a Christmas wish, but a phishing vish!

I hope I didn't confuse you all too much with the topic, but today I would like to write a few words about a concept that is called vishing. It is not a typo, meaning that I really wanted to write about wishing, but it truly is vishing. Vishing is a word generated from the combination of "voice" and "phishing." If you combine those two it would be voicephishing, but I guess they found it easier and cooler to call it vishing.

Two days ago, I wrote about formjacking, and I have written about ransomware as well earlier. I guess some of you might find these articles to be boring, but I do hope some of you will find these useful, and maybe they will also help you if you ever fall victim to such attacks in the future. But, let us forget about ransomware and formjacking right now, and let us rather focus on Vishing.

Illustration from the IP Address Guide.

What is vishing?

Phishing is the activity of someone stealing your data through using malicious sites, fake sites, installing spyware on your computer as you install software you expect to be clean and safe, or making you click links that activate malicious content on your computer. The result is that your confidential information is shared with 3rd parties that shouldn't get hold of that information.

Vishing is almost the same, but here the phishing is done through the voice, as someone is calling you to get hold of that secret/confidential information. It can sound like this:

"Hi there,
I am John, calling you from your bank. Can you please confirm that you are Mark, living in Fishingstreet 10, 10510 SoonToBeRobbed!"

"Yes, that's me."

"Before we can continue, can you please share with me your social security number, just to make sure that I am speaking to the real Mark?."

"Of course... it is 994 453 453"

And there you go... poor Mark has already shared information he wasn't supposed to share, and that a real bank employee would never ask for in a phone call. The trick is that the caller often use information not known by everyone, but that is easily accessible based on your social media sites, previous data breaches, and other info they find about you online. He also claims to be from a bank, a security agency, or some similar company.

---

Above he is taking advantage of that information to gain trust, and thus, the receiver of the call hands out information that should be secret.

It can also happen that they call you about your bank card being abused, and you need to give them your credit card details for them to stop the abuse from happening! Isn't that scary? Or maybe you will get a dream deal on banking deal with 100% gain in the first year if you make the deal right now, within five minutes.

There are many variations, but the goal is always to make you give away your confidential information in such a phone call. It can often be hard to discover the trick, but some basic good advice are.

Advice to keep you safe in cases of vishing

• No real institution will EVER ask you to give away secret information in a phone call like that.
• If you are insecure, hang up, find the REAL telephone number of the institution said to call you, and call them back on that number. Never call back on the number the person in the phone gives you.
• Hang up...
• Don't answer phonecalls from hidden sources.

These are just some pieces of advice. But, if you have actually read this article, I hope you will be a bit more aware of the fact, which will make a bell ring if anyone will ever call you with such intentions in the future.

Take care, be safe, and thank you for reading!