Vishing: How a Phone Call Scam Works and How to End One

Where the name vishing comes from

The name joins voice with phishing, the term for fake messages that try to fish information out of whoever receives them. What changes on a call is that the person running the scam answers your questions in real time and adjusts the story to whatever you say. That is why a confident, well handled call can still be fake: the confidence is the product.

The call often starts in writing. A text warns about a large purchase and asks you to call a number to cancel it, which joins a scam text to the phone call that follows. Once you are on the line, the conversation uses the standard tools of social engineering: authority, urgency, and a problem that only the person on the phone says they can fix.

The FTC groups these under impostor scams, and the FBI lists the same pattern among common frauds and scams. The name on the caller ID changes. The mechanism does not.

The script of a fake fraud department

The versions repeat with small variations: a large suspicious purchase on your card, a new phone that has just been linked to your account, an investigation that requires moving your money to a safe account while it is sorted out. The caller may transfer you between departments, put you on hold with music, and read back details that are correct, all of which is there to make the call feel like a real institution.

There is a version aimed at older adults built on a family emergency instead of a bank, covered in our guide to grandparent scams, and a version built on a refund you never requested, covered in refund scams. The opening differs and the ending is the same.

What a real bank never asks for

This is the part worth memorizing, because it settles the call without any judgment about how convincing the caller was. If someone on the phone asks for one of these, it is a scam:

• your full password, your PIN, or the one-time code your app or a text message just generated;
• a transfer or a payment to fix a problem on your own account, including to a safe account, a protected account, or an account in your own name;
• the installation or the update of an app while you are on the call;
• your card handed to a courier, or cash handed to someone who comes to collect it;
• a test payment, a test refund, or a small transfer to confirm that something works.

Banks also do not use pressure and a countdown to get you to act in the next minute. The Office of the Comptroller of the Currency keeps a plain list of common scams and how they work, and the pattern there is the same: a real employee does not need you to move money to prove the account is yours.

Government callers work the same way. The Social Security Administration says it will not threaten arrest or demand immediate payment over the phone, and takes reports of impersonation at the Office of the Inspector General. The IRS keeps its own list of tax scams for the same reason.

Hang up and call back yourself

While the call is going, the person who dialed controls the pace and has an answer ready for every objection. You are not going to win that exchange, and you do not have to. Hang up, and find the number yourself: the one on the back of your card, the one inside the app you already installed, or the one on the company’s own site typed in by hand.

Use a different phone for the call back if you have one available, or wait a minute before dialing. It costs nothing, and it removes any doubt about whether the earlier call really ended.

A real fraud department accepts being called back on an official channel. If the person insists that the call cannot end, that you must not tell anyone, or that hanging up will cost you the money, that is the strongest signal in the whole conversation. Hanging up also buys you the thing the script is designed to deny you: a minute to open the app and see whether the purchase exists, and a minute to say the whole story out loud to someone else.

The number on your screen proves nothing

A caller can make almost any number appear on your screen, including the number printed on the back of your own card. The FCC explains this in its guidance on unwanted robocalls and texts, where faked caller information is treated as standard equipment for this kind of call. So do not use the recent calls list to call back, because that just redials the scammer.

Carriers have rolled out caller ID authentication, and some phones now label a call as verified or flag it as likely spam. That labeling is a useful signal and nothing more. A missing label does not mean a call is fake, and a label that says verified is not a reason to read out a code, approve a prompt, or move money while you are still on the line. No badge changes the rule about what a bank never asks for.

Voices are not proof either. A recorded clip is enough to imitate how someone sounds, which matters most in the family emergency version of this call. The answer is the same as it has always been: end the call and reach the person on a number you already have.

If you already sent money

1. Call your bank now, on the number from the back of your card or inside the app, from a different phone if you can. Say the payment was fraud and ask them to lock the account, the app, and the card. The Consumer Financial Protection Bureau explains your position on an unauthorized transaction on a bank account.
2. Say how you paid, and ask what recovery options exist on that payment type, because they are genuinely different. A card charge has a dispute process. A wire can sometimes be recalled if the request goes in fast, which the OCC covers in its page on fraudulent wire transfers. An instant payment to another person is the hardest, and the CFPB’s page on money transfers is honest about that. Ask the question rather than assuming the answer.
3. File a police report. Banks, card issuers, and insurers frequently ask for one, and it costs you nothing but the time.
4. Report it to the government. File with the FTC at ReportFraud.ftc.gov and with the FBI’s Internet Crime Complaint Center, which is where internet and phone fraud complaints are collected and routed. Your state consumer protection office is worth adding too, and USA.gov lists them by state.
5. Write down everything you remember about the call while it is fresh: the time, the number that showed on screen, the name the person used, the department they claimed, and exactly what they asked for. Keep receipts, confirmation numbers, and every case number you are given.

Anyone who contacts you afterward promising to get the money back for a fee is running a second scam on the same list of victims. The FTC has a page on refund and recovery scams for exactly that.

If you installed an app they asked for

Most apps requested during these calls are remote access software, the kind of program that lets another person see and control your screen from a distance. Once it is running, the caller does not need your password: they can watch you type it.

Disconnect that device from the internet and stop opening important accounts on it. Use a different device to call your bank and to change your passwords, starting with your email, because whoever controls your email can reset almost everything else.

Then, on the bank, the email, and any messaging account, find the list of connected devices or active sessions and sign out anything you do not recognize. Google documents this for a Google account, and Apple documents the same for an Apple account. After that, delete the app, and if you are not sure the device is clean, take it to a repair shop you trust. Our guide to knowing whether your phone is hacked covers what to look at and in what order.

Vishing FAQ