What is vishing? Scam calls and cloned voices in 2026

When the phone rings and someone else is in a hurry for you

In short: vishing is fraud by phone call. Someone calls and pretends to be your bank, the police, a courier, an “investment adviser” or even a relative, then rushes you into one action: reading out a code, approving a payment, installing an app or moving your money to a “safe account”. The number on your screen can be faked and the voice can be cloned. The rule that protects you stays simple: hang up and call back yourself, on an official number you looked up on your own.

The word combines “voice” and “phishing”. It is the same trap as phishing, except the bait is a voice instead of a message.

• The attacker does not break into anything. They persuade you to open the door.
• Most of the time they do not want your password. They want your action: a code read over the phone, an approved notification, an installed app, a transfer you make yourself.
• Because the money leaves by your own hand, the bank sees a payment approved by the customer. That is why getting it back is hard.

Vishing is one of the attack vectors, the doors scammers use to get in.

• “This is your bank, your account is at risk.” The most widespread script. It ends with a request for codes or a transfer to a “safe account”, which belongs to the scammers.
• The fake officer. The caller says your identity was used in a crime, sends a photo of a “badge” on a messaging app and transfers you to a second “official”.
• “Tech support.” You are told your phone or computer is infected and asked to install a remote access app. Through it, the attacker sees your screen, opens your banking app and makes payments in your name.
• The “investment adviser”. After you leave your number on an ad, a “consultant” calls daily to help you “open the account”. I covered this in the article on trading platform scams.
• The relative in trouble. A voice that sounds like your child or grandchild says there was an accident and money is needed right now. The voice can be cloned from a few seconds of public audio.
• The courier, the tax office or the utility company. A small debt, a blocked parcel or an unpaid bill, followed by a request for card details.
• The call that follows a message. First you get a text or an email with an “urgent” number. When you call it, the same people answer.

• AI now has its own line in the FBI report. The FBI’s 2025 Internet Crime Report, published in April 2026, counted complaints that mention artificial intelligence for the first time: 22,364 complaints and about $893 million in losses. Calls using the cloned voice of a relative “in trouble” alone accounted for more than $5 million.
• Fake officials nearly doubled. In the same report, complaints about people posing as government officials rose 87% in a year, to 32,424, and losses almost doubled, to $798 million.
• “Tech support” calls cost $2.1 billion. Tech and customer support scams brought 47,794 complaints, with losses up 46% from the year before.
• Older people lose the most. People aged 60 and over reported $7.7 billion in losses in 2025, with an average loss of about $38,500.
• The trend continues. The APWG report for the second quarter of 2026 says vishing hit new highs and rose 20% from the previous quarter.

The practical conclusion: the number on the screen and the voice are no longer proof. The only proof is the call you make yourself.

• Urgency. “You have three minutes before the money leaves.” Under pressure, people stop checking.
• Authority. Bank, police, central bank, tax office. An official title stops the questions.
• Fear. A loan in your name, a criminal case, a child in an accident.
• Isolation. “Do not hang up” and “do not tell anyone, the investigation is confidential” have one purpose: to keep you from asking someone.
• The faked number (caller ID spoofing). The attacker can make your bank’s real number, or an institution’s number, appear on your screen.
• Correct details. Your name, your address or the last digits of your card prove nothing. That information has been circulating for years.

• Hang up and call back yourself. Use the number on the back of your card or on the official website, typed in by you. Do not call back the number that called you and do not use a number the caller gives you.
• Codes are for no one. Not the bank, not the police, not your family. Read the whole text message: it often says what payment the code is for.
• Do not install apps because a caller asked. Especially remote access apps.
• Approve only what you started. A notification that appears out of nowhere in your banking app gets rejected.
• Agree on a family password. One word only you know, asked for on any “something happened, send me money” call. If the voice does not know it, hang up and call the person yourself.
• Set card limits and transaction alerts. A low daily transfer limit reduces the damage even if you were fooled.
• Talk to your parents and grandparents. Say it plainly: “the bank does not call to ask for codes. If someone calls, hang up and call me”.
• You are allowed to be rude. You can hang up without explaining. A real institution does not mind being checked.

The first minutes matter, because a transfer can sometimes be stopped.

• Call your bank immediately, on the official number. Ask them to block the card and app access, and say you were the victim of fraud.
• If you installed an app at the caller’s request, turn off the internet on that device and uninstall it before you open your banking app again.
• Change your passwords for email and online banking, from another device.
• Keep the evidence: phone numbers, call times, messages and screenshots.
• Report it to the police. Without a report, the bank and the authorities have few options.
• Report it to your national fraud service. In the United States, use ic3.gov and reportfraud.ftc.gov. In the United Kingdom, call 159 to reach your bank safely and report to Action Fraud.
• Watch for the second call. Victims are called again by “recovery firms” that promise the money back for a fee. It is the same fraud, part two.

Do not be ashamed and do not wait. The callers are professionals who rehearse the same script dozens of times a day.

No. Banks do not ask over the phone for passwords, your PIN, codes received by text or the approval of a transaction. If someone asks, it is a fraud attempt, however official it sounds.

Most of the time you cannot tell by ear. Ask a question only the real person can answer or ask for your family password, then hang up and call them on their usual number.

• What is an attack vector? The doors scammers use in 2026
• How to navigate the waters of phishing attacks
• What is smishing? Fake text messages about parcels, fines and banks in 2026
• What is malware? Fake apps, infostealers and ransomware in 2026
• What are deepfake videos and how do you protect yourself in 2026?
• Free resources: the Q4 Reset guide and the “first 10 minutes” emergency plan

Brîndușa Maria, Senior Software Test Analyst, ISTQB® Certified Tester Advanced Level Test Analyst (CTAL-TA). I write about how to recognize online scams. LinkedIn

Note: this article is based on my research and professional experience. I used artificial intelligence tools for drafting and editing.