What is vishing? How to check a call before acting

What vishing is, and where it can start

Norton’s page says vishing, short for “voice phishing,” is a phone-based cyberattack in which a scammer may try to get you to share personal and financial details such as bank account numbers and passwords. Cisco’s page gives nearly the same definition: phone calls or voice messages meant to trick victims into handing over sensitive information such as logins, card numbers or bank details. Norton adds that the call may come from a live person or from a recording, a robocall, and that the goal is the same either way.

Both pages set vishing beside two other words. Cisco lists vishing as the phone, phishing as email and smishing as text, with the same aim for all three: taking control of accounts, committing fraud or stealing funds. Norton calls vishing and smishing types of phishing that use different channels, and it describes phishing itself as using emails, texts, calls or online messages. The two pages therefore draw the line between “phishing” and “vishing” in slightly different places. Our page on the two words, vishing and smishing, covers the vocabulary; this one is about the call.

Cisco also says a vishing attack does not always start with a call. Many begin with an email that urges the recipient to dial a number. It lists three possible reasons such an email can get through email filters; two of them are that security systems easily flag emails with malicious links and this one has none, and that phone numbers, unlike web addresses, are not routinely tracked and shared as indicators of compromise. Cisco’s page promotes its own email security product, so we use it for what it says happens, not for what to buy.

Both Norton and Cisco list kinds of call. Cisco names seven: a tax agency, tech support, the bank, Social Security or Medicare, a delivery company, a loan or investment, and a cloned voice. Norton names eleven, among them bank, tech support with remote access, delivery, prizes, a grandchild in trouble and an executive. For the cloned voice, our page on voice scams goes further.

What the caller already knows proves nothing

The FTC’s consumer alert of 30 January 2026 describes a call that claims fraud on your card, a hacked bank account, a tax debt or benefits about to end. It says the caller might know your full name, your address or your accounts, and that this does not make the caller trustworthy, because scammers buy or steal this information to make the lies seem believable. Cisco says the same in its list of signs: scammers may show what looks like personal knowledge gathered from online sources or social media, and knowing an address, recent transactions or family details does not confirm that the caller is genuine.

The number on the screen is the second thing the pages warn about. Cisco says spoofed numbers can be subtly different from the real ones, so a number that closely resembles a bank’s may pass unnoticed, and that caution applies even when the display shows a local number or a name you recognise. Norton says a spoofed caller ID can make the call appear to come from the bank, the police or the government, and that automated dialling lets scammers place thousands of calls at once. Because these exchanges happen in real time, Norton says, they often bypass the filters that catch suspicious emails or texts. As an example Norton gives a UK victim who lost money after fraudsters called from what seemed to be the bank’s own number. The detail of how a number is faked is on our spoofed caller ID page.

The FCC page describes what it is doing on the carrier side: in April 2026 it proposed a fine of $4.5 million against a phone provider that, it says, allowed tens of thousands of fake calls pretending to be from banks. The word is “proposed”; the page does not say the fine was imposed. Cisco adds a warning about voices: in its tips it says that AI can replicate a person’s speech from as little as a 3-second clip.

The callback rule: hang up, then use your own number

The pages we read that tell you what to do with a suspicious call share one move. The FCC says that when a call claims to come from a bank or a card issuer, you should hang up and call back on the customer service number printed on your account statement or on the back of your card. The FTC’s alert of July 2024 says to use the number you find on your statement and never the number the caller gave you, which, it says, “will take you to the scammer.” The FDIC says to call your bank directly using a number you are familiar with, like the one on your debit or credit card, and not a number provided by someone unfamiliar.

Cisco and Norton give the same rule in their own words. Cisco says that instead of following the caller’s instructions you should hang up and call the institution or person directly, and that you should always avoid numbers provided during the suspicious call. Norton says that if the caller provides a call-back number, it may be part of the scam, so you should not use it.

The pages do not agree on the very first step. The FTC says “Get some basic details, then hang up”: which company or bank the caller says it is calling from, and what the problem is. Cisco has a similar step in its prevention list: ask the caller to confirm identity, note the name, then reconnect on a number from the organisation’s official website or your own records. Norton and the FCC do not wait: Norton says to hang up and block the number once you suspect a vishing call, and the FCC lists hanging up immediately when someone asks for money or personal information. The pages we read do not say whether one of these orders is safer than another.

Calls you did not answer are a separate case. Norton says to let unknown numbers go to voicemail, listen to the message and then decide whether to call back. Cisco says to refrain from redialling a missed call from an unfamiliar number and to look for official numbers on websites, cards or account statements. The FCC’s list says not to answer calls from numbers you do not recognise. Our page on unknown numbers looks at what can be found out about one.

Where the pages send you to find the number

The rule says to call a number you found yourself, but the pages do not all say where to find it. The FCC, the FTC in July 2024 and the FDIC point to the card or the statement. The FTC’s January 2026 alert is wider: it says to use the official app or website to reach the fraud department, or to call the number on a recent statement or on the back of your card. Cisco points to a verified number from the organisation’s official website or your contacts, and also to cards and account statements. Norton says to search for the company’s official phone number.

That last instruction sits next to a warning. The FTC’s January 2026 alert says not to trust the top search results for a company’s contact details, because scammers often pay for search ads that put their fake numbers first in the listings. The statement, the card and the app are the three places the FTC names. Norton’s page does not mention paid search ads, and the pages we read do not say how its advice fits with the FTC’s warning.

Norton, whose page is written for readers in the United Kingdom, adds a number the US pages do not: it says that calling 159 connects you directly to your bank. The pages we read do not mention an equivalent for the United States, and they do not say what to do when the number on the card is busy, rings out or leaves you waiting for a long time.

What the pages say a call about your money will not ask

The FCC page says bank impersonators typically press for immediate action to secure an account or protect money. A call or text may carry a phony “fraud alert” that asks you to confirm account details or share personal information. A more complicated version claims the bank is helping a government agency look into suspicious activity on your account, and that to keep the money safe you must send it to another account or turn it into gold or cryptocurrency. The FCC’s answer is that, regardless of the pitch, it is always a scam, and that banks will never call or text to ask you to move your money. It adds, citing the FTC, that bank impersonation accounts for the highest losses of any impersonation category.

The FTC’s July 2024 alert says the same about moving money, and adds the verification code. “Never share a verification code,” it says, because the scammer can use the code to prove they are you, and it says a caller will not ask for it, even one from a bank’s fraud department. It also says bank accounts have different, and fewer, protections than credit cards, so if you are scammed into moving money out of an account you may not get it back. The January 2026 alert adds three more items: never share personal or account information, never grant remote access to a phone or computer, and talk to a trusted friend or family member, since a legitimate fraud department will not tell you to keep the call secret. Cisco lists the same secrecy among the tactics to watch for.

The FDIC describes how the pieces can chain together: a text asks you to verify a large purchase you did not make, and if you respond, a call follows from someone posing as the bank’s fraud department. The FDIC, citing the FTC, puts the typical loss of a consumer who falls for this scam at $3,000, and the figure is about the text-then-call pattern, not about calls alone.

Cisco says to leave voice prompts alone. If a recorded call asks you to press a button or answer yes or no, Cisco says, scammers use that to confirm they reached a real and compliant person, which can lead to more calls. The audio example on the FCC page, a recording that says it is a company’s automated security system, asks you to press 1. Norton lists three signs of its own: urgency or fear, a request for information you did not ask to give, and poor audio or a robotic voice, which may mean a recording. In its questions section Norton also says the safest response is to disconnect right away, block the number and avoid saying anything that could be recorded or reused later, which fits Cisco's advice not to answer yes or no to voice prompts.

If you already answered

The FTC’s July 2024 alert says that if you get a call, text or message like this, you should tell your bank or fund right away, especially if you moved money or shared a verification code, and then tell the FTC at ReportFraud.ftc.gov. Cisco gives a longer list: alert your financial institutions and ask them to freeze or monitor your accounts, change compromised passwords and PINs, tell the company or institution the scammer claimed to represent, and file a complaint with the FTC or the FBI’s Internet Crime Complaint Center.

Norton starts smaller: end the call, then write down what was asked, the number displayed and anything that felt unusual. It then says to update your login details and review recent activity, and to contact your financial institution if you shared banking or payment information. Its reporting routes are British: Report Fraud for England, Wales and Northern Ireland, the number 101 for Police Scotland, and a free text to 7726 with the word “Call” followed by the scam caller’s number. The FTC and Cisco pages we read name only US routes.

If the voice on the call sounded like a relative, our page on voice scams covers that case, and if the volume of calls is the problem, our page on blocking and filtering covers the phone settings.

What we did not use

We did not open the pages of Proofpoint, Kaspersky or a bank’s blog on the same subject; an FDIC question-and-answer page returned only menu text and an error, so we did not use it. Norton and Cisco both promote their own security products, and we used their pages only for what they say about the calls. Norton cites a security company’s report for a rise in vishing that we could not check, so the figure is not repeated. The FTC’s 2024 page carries reader comments, which we did not use.

The pages we read do not give a count of how many people are caught by vishing alone: the FTC and FDIC figures they cite are about bank impersonation in general and about text messages. They also do not say whether to wait before calling back or to use a different phone, and they do not say what to do when the number on the card cannot be reached.