What Is Vishing (Voice Phishing) and How to Simulate It

Vishing, short for voice phishing, is a social engineering attack carried out over a phone call rather than through an email or text message. The attacker impersonates someone trustworthy, a bank representative, a courier, an IT support agent, a government official, and uses the conversation to extract sensitive information, push the victim toward a fraudulent payment, or talk them into installing remote access software. Unlike email phishing, vishing happens in real time, which changes the dynamics of the attack considerably.

That real-time element is exactly what makes vishing effective. A phishing email can be reread, forwarded to a colleague, or left unanswered while someone thinks it over. A phone call does not offer that pause. The caller controls the pace of the conversation, injects urgency, invokes authority, and reads the target's hesitation in real time so they can adjust their pitch on the spot. Combined with a plausible pretext, that live pressure short-circuits the moment of doubt that would normally lead someone to stop and verify.

Vishing rarely operates alone. Attackers frequently pair a phone call with a prior email or text message to make the follow-up call feel expected, or they spoof the caller ID so the number appears to belong to a legitimate organization. This layered approach means an organization that only trains people to spot suspicious emails is leaving a significant gap in its defenses, since the same person who correctly reports a phishing email may still comply with a confident voice on the other end of a call.

One of the most common vishing patterns reported in Indonesia involves a caller impersonating a bank call center, claiming there has been a suspicious transaction on the victim's account and asking them to confirm their identity by reading out a one-time password that just arrived by SMS. Because the scenario mirrors a real fraud alert process that banks do use, it is convincing precisely because it borrows the shape of a legitimate interaction.

A second common pattern involves someone posing as a courier or delivery service, calling about a package that supposedly cannot be delivered without an additional fee or a link that needs to be clicked to reschedule delivery. This works because online shopping and courier deliveries are part of most people's everyday routine, so the pretext requires no special effort to seem believable.

A third pattern involves a caller claiming to represent a tax or other government office, alleging an outstanding obligation or a legal issue that requires immediate action. This pattern leans heavily on authority pressure. Organizations should assume employees receive calls like these on their personal phones regardless of any workplace controls, and that corporate phone lines are targets too, for example an attacker impersonating an internal IT helpdesk to convince an employee to reset a password or read out a multi-factor authentication code.

A vishing simulation should start with written authorization and a clearly defined scope before a single call is placed. That means agreeing on which departments or roles are in scope, what a simulated caller is allowed to ask for, an exclusion list for sensitive individuals or numbers, and an escalation path in case something unusual happens during testing, such as a participant reacting as though the situation is a genuine emergency.

With scope agreed, the next step is building a realistic but safe script. A good vishing script is structured as a decision tree: an opening line that sets the pretext, branches that adapt based on how the target responds, and a data request step that stops short of ever collecting anything real, followed by a disclosure at the end of the call explaining that it was a simulation. Claro's vishing script builder supports exactly this structure, with opener, branch, data-request, and outcome nodes that let a security team design a call flow once and reuse it across a campaign.

Teams also need to choose between automated and guided delivery. Automated calls, where a recorded or synthesized voice follows the script tree and captures the outcome, work well for broad, lower-touch awareness campaigns across the general workforce. Guided calls, where a live team member runs the script in real time, are better suited to smaller, higher-value tests, such as checking whether the finance team follows its own verification process before approving a wire transfer request received by phone.

Every simulated call should be classified into an outcome, complied, refused, reported, no answer, voicemail, partial compliance, or hung up immediately, rather than reduced to a single pass or fail. Compliance rate alone is a narrow measure. A workforce where fewer people comply but almost nobody reports the suspicious call is arguably in a weaker position than one where compliance is similar but reporting is high, since reporting is what actually shortens an organization's exposure window during a real attack.

Whoever complies with a simulated call should receive a short, specific piece of training immediately afterward rather than days later. The memory of the call is still fresh, which is exactly the window in which a brief explanation of what red flag they missed will actually stick.

Finally, vishing results should feed into the same reporting and risk picture as email and other simulations rather than sitting in a separate spreadsheet. Tracking compliance and reporting trends across repeated campaigns, and folding those outcomes into an individual's overall risk profile, turns vishing simulation into part of an ongoing awareness program rather than a one-off exercise that gets forgotten as soon as the report is filed.