Vishing, in which an attacker uses voice calls to gain access to company or personal information, is on the rise. Vishing attacks grew by a whopping 442% in 2024 alone, according to CrowdStrike. They are also growing more sophisticated as AI enables voice deepfakes to impersonate customers and employees and engage in social engineering attacks.
Protecting against vishing attacks is increasingly top of mind for those responsible for enterprise communications platforms, according to Metrigy's "Workplace Collaboration Security and Compliance: 2027" global study of 403 organizations. Nearly 60% of respondents said they are adopting additional customer identity verification approaches to protect against vishing, and more than half are implementing security platforms specifically for that purpose.
What is vishing?
Vishing, or voice phishing, is when an attacker impersonates another individual, often using the individual's personal information to validate identity, such as a mother's maiden name, previous address or Social Security number.
Increasingly, vishing attacks use AI for deepfakes to impersonate the voice of an individual. For example, attackers can use vishing to impersonate job candidates to fraudulently obtain jobs. The past several years have seen well-publicized vishing attacks against companies, including Arup, Electronic Arts and Fideuram, that have compromised data and software or resulted in financial fraud.
Vishing's risk to enterprise communications
Voice remains critical to business operations. It is still the primary way customers solve issues and sales teams engage with prospects. Even in meetings, voice is critical to validate participants' identities, especially when discussing sensitive topics. Thus, vishing attacks often target enterprise calling, meeting and contact center platforms.
Vishing attacks can succeed under circumstances such as the following:
- The attacker uses social engineering techniques, such as claiming an emergency to trick staff into permitting them access to enterprise apps, bypassing MFA or SSO protections. For example, an attacker impersonating an employee who calls an IT help desk in a state of panic, claiming their phone was stolen.
- Attacks impersonating senior executives to gain company access in order to obtain sensitive information or commit fraudulent financial transactions.
An attacker using vishing to gain access to unified communications (UC) platforms can tap into additional information and resources, such as meeting notes, AI tools, messaging channels and connected apps. Once inside, they can also manipulate employee trust to carry out additional attacks.
Security leaders can take several approaches to minimize vishing threats, such as using STIR/SHAKEN protocols implemented by telecom carriers to validate caller ID and deploying voice security products and services from companies such as Pindrop and SecureLogix.
However, vishing risks remain from calls on networks that do not use STIR/SHAKEN; from connections made through open federation to apps, such as Microsoft Teams and Zoom; from supporting meeting join without ID verification; and from attacks targeting personal mobile devices outside of enterprise control.
A proactive approach is key
Protecting against vishing attacks requires a proactive approach that ensures the right organizational structure, policies and tools are in place. Security must be a shared effort, with the CISO and UC teams jointly owning protection and mitigation.
Metrigy's annual research identified strategies that correlate with above-average operational cost savings, productivity improvements and employee satisfaction gains. Successful companies are those that do the following:
- Ensure early engagement with security teams on all UC-related initiatives and include security requirements in all vendor selection assessments.
- Conduct regular assessments of risks, threats and mitigation capabilities.
- Create a security plan that identifies specific risks, protection mechanisms and response playbooks.
- Use third-party tools that protect against vishing attacks through identity validation, deepfake protection and attack signature detection.
- Ensure sufficient budget to minimize risks.
- Deploy advanced identity validation, including voice recognition with biometrics such as fingerprint or Fface ID that are harder for AI to impersonate.
- Ensure security approaches provide the UC team with visibility into SIEM platforms.
- Ensure security strategies evolve and adapt as threat vectors and capabilities change.
Specific operational approaches to minimize vishing risk include:
- Policies requiring a callback on a trusted, known number.
- Never resetting security credentials over the phone.
- Using out-of-band services for managing payments and personally identifiable information.
- Limiting external federation for messaging platforms.
- User education and awareness.
- Authenticating all meeting participants.
Vishing attacks are a growing threat to enterprise IT resources and customer information. CISOs must implement a proactive approach that identifies risks, mitigates them through identity and access management and vishing protection, and continues to evolve vishing protection capabilities as threats change.
Irwin Lazar is president and principal analyst at Metrigy, where he leads coverage on the digital workplace. His research focus includes unified communications, VoIP, video conferencing and team collaboration.
