Your phone rings, and the caller ID shows your bank’s name. A calm, professional voice tells you there has been suspicious activity on your account, and they need to verify your identity to protect your money. Everything about the call feels legitimate — the hold music, the badge number, the urgency in the caller’s voice. That is exactly the point. This is vishing — voice phishing — a fraud carried out entirely over the phone, and it remains one of the most effective scams in the world.
The scale is enormous and growing. The FBI’s Internet Crime Complaint Center logged more than 22,000 AI-linked fraud complaints in 2025, with reported losses of nearly $893 million — and AI voice cloning is one of the fastest-growing weapons in the scammer’s arsenal. Separately, the FTC reports that consumers filed over 1 million imposter-scam reports in 2025, losing nearly $3.5 billion. Older adults are hit hardest of all: 24% of older scam victims told the FTC the fraud started with a phone call, compared with just 10% of younger consumers.
This guide breaks down exactly how vishing calls work — the technology behind them, the script the callers follow, and the psychology they exploit — plus the red flags that expose them, the steps that keep your money safe, and what to do if you have already shared information on a call.
How a Vishing Call Works, Step by Step
Most vishing calls follow a rehearsed script. Understanding each stage makes the whole performance easy to spot.
1. The setup: a familiar number on your screen
Scammers use caller-ID spoofing to make any number appear on your display — your bank, the IRS, the police, even a family member’s number. They often pair this with personal details bought from data breaches: your name, address, or the last four digits of an account. When the caller already “knows” things about you, your guard drops.
2. The hook: manufactured urgency
The caller invents a crisis that demands immediate action: suspicious transactions on your account, a warrant for your arrest, a compromised Social Security number, or a relative in trouble. The goal is to trigger panic, because panicked people stop thinking critically. Real organizations do not operate this way — they do not demand instant decisions on a cold call.
3. The script: “verification” that harvests your data
Next comes the extraction. The caller asks you to “verify” your identity by reading out your full account number, Social Security number, passwords, or the one-time code that just arrived by text. Every answer goes straight to the criminal. A common variation: they tell you not to tell anyone — not your bank, not your family — because “the investigation” requires secrecy. That secrecy exists only to stop you from getting advice that would expose the scam.
4. The close: moving your money
The finale depends on the script. Bank-impersonation callers ask you to transfer money to a “safe account” (the scammer’s account). Government-impersonation callers demand payment in gift cards, wire transfers, or cryptocurrency — payment methods that are nearly impossible to reverse. Tech-flavored vishing asks you to install remote-access software so the caller can “fix” your computer, which really gives them control of your machine.
Why Vishing Still Works in the Age of AI
You might expect phone scams to fade as people get savvier. The opposite is happening, for two reasons. First, artificial intelligence has industrialized the con. A few seconds of someone’s voice — scraped from a voicemail greeting, a social media video, or a recorded call — is now enough to clone it convincingly. The FBI has specifically warned that criminals use AI-generated audio to make family-emergency scams sound real, right down to the sobbing.
Second, the psychology is timeless. A confident human voice triggers trust in a way text cannot. Authority (“this is Officer Daniels”), urgency (“you have 30 minutes”), and fear (“your accounts will be frozen”) bypass rational thinking. Scam call centers train their operators like sales teams, complete with scripts, objection handling, and performance targets.
Red Flags of a Vishing Call
Run every unexpected call through this checklist. Any single hit is reason to hang up:
- They called you, not the other way around — banks, the IRS, and police do not cold-call about urgent account problems or arrests.
- manufactured urgency — threats, countdowns, “act now or else.” Pressure is the scammer’s main tool.
- They ask for sensitive information — full account numbers, passwords, PINs, or one-time codes. Legitimate callers never ask for these.
- They ask you to keep the call secret — “don’t tell your bank or family.” Real officials welcome verification.
- Payment in gift cards, crypto, or wire transfers — no legitimate organization demands these over the phone.
- They want remote access to your device — a caller asking you to install screen-sharing software is running a scam.
- The story doesn’t quite add up — a “bank” that can’t tell you your branch, an “officer” who gets angry when questioned.
- They get hostile when you hesitate — threats and insults are a pressure tactic, not professionalism.
- Odd background noise or robotic speech — many scam calls come from crowded overseas call centers.
- They knew some of your details already — breached data makes the call feel personal; it proves nothing about the caller.
How to Verify Any Caller: 6 Steps
Never try to outsmart a scammer mid-call. Instead, follow this routine every time:
- Hang up. It is always safe to end a suspicious call. You lose nothing by hanging up; a legitimate matter will still be there in ten minutes.
- Call back on a number you trust. Use the number on the back of your bank card, the organization’s official website (typed by you, not clicked from a message), or your phone’s contacts.
- Never use contact details from the call itself. Callback numbers, websites, and “case portals” provided by the caller are part of the scam.
- Ask for specifics in writing. Real banks and agencies will send official letters or secure messages. Ask for a reference number and verify it through the official channel.
- Slow everything down. Tell the caller you need time. Scammers hate delays; legitimate organizations accept them.
- Set up a family safe word. For “relative in trouble” calls, agree on a secret word with family members. A real emergency caller will know it; a voice clone will not.
What to Do If You Already Shared Information
Act quickly and methodically — speed matters more than embarrassment:
- Shared bank or card details? Call your bank immediately on the number printed on your card. Ask to freeze the card, flag the account, and dispute any unauthorized transactions.
- Shared your Social Security number or ID details? Place a fraud alert with the credit bureaus and consider a credit freeze. File a report at IdentityTheft.gov, which generates a personal recovery plan.
- Read out a one-time code? Change the password on that account right away from a trusted device, and enable app-based two-factor authentication.
- Gave remote access to your computer? Disconnect from the internet, uninstall the remote-access software, and run a full security scan. If online banking was accessed, treat it as compromised and change those credentials from a clean device.
- Sent money? Contact your bank or payment provider at once to request a recall. Then report to the FTC and the FBI’s IC3 — include every detail, including phone numbers and payment addresses.
How to Report a Vishing Call
Reporting helps investigators map scam operations and warn others:
- Report to the FTC at ReportFraud.ftc.gov — include the number that called, what they claimed, and what they asked for.
- Report to the FBI’s Internet Crime Complaint Center at ic3.gov, especially if you lost money or the caller impersonated a government agency.
- Report the number through your phone’s built-in spam reporting and to your carrier.
- Warn people around you. Vishing disproportionately targets older adults — a two-minute conversation with a parent or grandparent about hanging up on cold callers is one of the most effective defenses there is.
The Bottom Line on Vishing
Vishing works because a confident voice plus manufactured urgency short-circuits skepticism. The defense never changes: hang up, verify through a channel you trust, and never share sensitive information or move money because a caller told you to. Make “hang up and call back” an automatic reflex, and vishing calls lose all their power — no matter how convincing the voice on the line sounds.
Sources
- FBI Internet Crime Complaint Center, “2024 Internet Crime Report” — https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf
- SQ Magazine, “Voice Phishing Statistics 2026” — https://sqmagazine.co.uk/voice-phishing-statistics/
- IPWatchdog, “FTC Seeks Comment on Proposed Rule to Crack Down on Platform Facilitation of Impersonation Scam Ads” (September 28, 2026) — https://ipwatchdog.com/2026/09/28/ftc-seeks-comment-on-proposed-rule-to-crack-down-on-platform-facilitation-of-impersonation-scam-ads/
- 9to5Mac, “FBI says cyber fraud cost Americans $21B last year” (April 8, 2026) — https://9to5mac.com/2026/04/08/fbi-says-cyber-fraud-cost-americans-21b-last-year-heres-what-you-need-to-know/
Last reviewed: October 2026
This article is for education only and is not financial or legal advice.