What is Vishing?

Vishing is a phone fraud that uses social engineering to exploit human psychology rather than technical systems, and is a method that has been around for decades. Historically, the technique of phishing for credentials has been extremely successful and has been shown to evade even the most advanced security systems and defensive technologies. What’s more, as businesses have been challenged with the rapid migration to remote working, hackers have ramped up their efforts to take advantage of the lack of in-person verification.

In comparison to the infamous email scams that are rife, cybercriminals have recently revived the more traditional technique of vishing (voice phishing by phone). Whilst many may think they will spot the old-school scam, hackers have improved their techniques to avoid suspicion and unfortunately, increased their chances of success. The threat of vishing has grown to such a scale that in August 2020, the CISA and FBI issued a joint security advisory warning about the ongoing wave of attacks. With an increase in all types of fraud to misuse information, vishing must be on every organisation’s radar.

VISHING EXPLAINED

In simple terms, vishing is the fraudulent practice of extracting sensitive information over the phone. Cybercriminals will spend time compiling information on targets from public profiles on social media platforms to enable them to create convincing personas. They will then pretend to be an authority figure which includes simple telemarketing and technical support frauds, as well as implementing more complex government and financial institution impersonations. By calling employees at home and combining one-on-one phone calls with credible-looking phishing sites, hackers can collect login credentials for corporate networks and then later monetise the information by selling the access to other groups.

While vishing is often the work of independent hackers or small cybercriminal groups, some government-backed groups now integrate vishing into their arsenal. Vishing offers a more controlled tactic to ensure the success of the initial phishing phase. Some notable recent examples include:

• The Ritz London – the five-star London-based hotel was targeted in August 2020 with a convincing phone-based identity fraud attack within its food and beverage reservation system. Personal data was compromised, albeit not credit card details or payment information. However, the guest’s details were then used in follow-on fraud attempts. The hackers called up diners on a spoofed number to enquire about their restaurant bookings in the hope of obtaining their card details.
• Twitter – the leading social networking site was victim to a phone spear-phishing attack in July 2020. The hackers called up employees at Twitter and used failed identities to trick them into giving up credentials to an internal company tool. Using this, they were able to reset the passwords and two-factor authentication codes of target user accounts. The 130 targeted accounts include CEOs, celebrities, and politicians, which were then used to share bitcoin spam with their followers.
• GoDaddy – the well-known web hosting company fell victim to a vishing attempt in November 2020. Hackers managed to convince GoDaddy employees to hand over control to a couple of cryptocurrency trading websites. Email traffic was redirected without authorisation, and user funds had to be frozen for 24 hours. No personal information was reported to have been stolen during the attack, but it is yet another example of vishing being used to trick companies with malicious intent.
  

HOW DO VISHING SCAMS WORK?

As with all phishing attacks, vishing preys on human emotions, commonly greed or fear, to convince victims to disclose sensitive information. However, they are particularly successful due to our innate nature to trust human voices. This puts elderly or technophobic people at increased risk as they have less knowledge and experience of this type of scam. Having said that, everyone is still at risk.

While some vishing attacks work by scammers using auto-dialers to call as many people as possible until someone answers, they are often extremely targeted. To make them successful, many vishing scams will leverage mass scraping of public profiles on social media platforms and publicly available background check services to gain as much information as possible. With the information gathered, scammers effectively impersonate trusted figures. Additionally, the use of spoofed caller IDs and supporting phishing web pages that look like the targeted companies or spoofed websites can seem incredibly convincing.

Once a hacker obtains information, they may directly use it to steal money, impersonate a victim to further penetrate a network, or sell the information for financial reward. After this successful attack, the scammer will usually disappear. Hence cybercriminals take many steps to hide their identities, which makes finding and prosecuting them is highly difficult.

HOW TO PROTECT YOUR BUSINESS FROM VISHING

Human error is one of the major barriers to a successful cyber security strategy. A simple mistake by an employee can lead to serious consequences. As vishing attacks are targeted directly at people, it stands to reason that prevention should be observed from the same perspective. This involves educating and fostering a healthy level of suspicion so that individuals are aware of how to identify and prevent phishing attempts. Cyber Security training should ensure employees are:

• Cautious of unknown callers – if the caller is unfamiliar, employees should ask for the caller’s name, who they work for, and all applicable details. Employees should never give out any information and should cross-check all information.
• Vigilant at all times – it is difficult to always be on guard, but that is what vishing relies on. Employees should be aware not to fall for calls that attempt to play on their emotions.
• Unreliant on caller ID – if employees automatically trust caller IDs, it makes it easier for spoofed numbers to trick them. While nuisance calls may be avoided, scammers can still get through.
• Unwilling to give details – unless a request is undeniably from an official channel, employees should never share login information, provide account data or identifiable information, or change logins or passwords over the phone.
• Inclined to double-check – urgent requests for financial information should not be immediately trusted. Employees should always take time to double-check authenticity and ideally, an approval process should be firmly in place.
• Aware of acceptable requesters – as well as having agreed channels for sharing information, employees should be aware of a list of names of those who may request certain information.
• Familiar with the reporting process – employees should make a point to record suspected calls or fraud attempts so that further attempts can hopefully be prevented.
  

HOW PROTECTED IS YOUR ORGANISATION?

When it comes to vishing or phishing attempts, the only real protection the end-user has are their wits and suspicion that something is not right. This makes education and awareness a vital part of every organisation’s cyber security efforts. To find out how well your business is protected and what you can do to secure your information, get in touch for a cyber security maturity assessment.

‍