Cybersecurity “Vishing” Attacks — All You Need to Know

The spate of cyber attacks has significantly remained on the increase, and there are no signs of it slowing down — not with the continued reliance of individuals, small businesses, educational institutions, and of course governments around the world on Cyberspace.

This reliance has made cyberspace to generate a vast and unending pool of sensitive data and information which are of very high value, hence making it a gold mine and prime target for cyber criminals to exploit.

If we examine this from the perspective of information technology versus the humans who generate, process and store/transmit the information, we can try to determine which aspect is the most vulnerable to the tactics and techniques of the cyber “Bad Actors’’. Over time it has been determined that the weak-link in the chain is the “end-user” side. To a considerable extent, the Information Technology security side has matured over the years and is constantly being developed. Several reports have attributed a very high percentage of cyber attacks to human error. According to thrivedx, 95% of cybersecurity breaches are caused by human error which apparently were preventable.

What is Vishing?

Now, one of the ways this end-user cyber attack occurs is through a tactic called “Vishing” — which is simply a social engineering attack that occurs over a telephone call, whereby the caller attempts to use psychological manipulations to trick users into divulging personal/organizational sensitive information.

Phishing is a more common term which involves hackers sending enticing or compelling emails sometimes claiming to be a known organizational users, but with malicious attachments in form of documents and pictures. Vishing is simply the voice version of phishing!

What is the Primary Purpose of “Vishing” Attacks?

The ultimate aim of a vishing attacks is to steal valuable information such as login details, Personal Identification Numbers (PIN), and bank account details which is usually targeted at gaining access to the victim’s bank accounts.

How to Recognize Vishing

Vishing attacks comes through phone calls either on personal mobile or organizational phone systems. The main red flag to look out for is when the caller presents a frantic sense of urgency, which sometimes sounds like a threat. Sometimes the call may not come from a human at the other end, but an automated call with instructions to key in information via the telephone keypads.

Also, it is worth noting that the callers are usually experts in their field or self-acclaimed experts, and attempt to use the right professional terms in their communication. They could masquerade as IT technicians, financial advisers, bankers, or even medical personnel.

Emails and/or text messages do usually get sent to the recipient as follow-up to the vishing calls, with malicious links that can lead to compromised websites designed to harvest sensitive information like passwords and credit card details. Also, the attackers do call with different numbers, thereby making it difficult to get them blocked.

Vishing Attacks Statistics

According to statista, “In the second quarter of 2023, the volume of vishing attacks worldwide saw a 10 percent increase since the previous quarter. This change was more significant in the two preceding quarters when a 40 percent increase was detected”.

Precautions Against Vishing Attacks

i. Avoid getting swayed by the sense of urgency presented by the call requesting for sensitive information

ii. Endeavor to keep the communication going and try to gather and write down some information about the caller, which can be useful for cyber incident management investigations.

iii. In the case of automated calls, kindly drop the call and do not attempt to press the keypads to provide any information like PIN and banking card details.

iv. Report suspected vishing incidents to your organizational IT or on relevant government platforms.