Topic starter
23/10/2026 12:47 am
TL;DR: AI vishing turns voice trust into an attack path because the approval process fails first, according to Riot. SSO, CRM, cloud and payment workflows need independent verification before any sensitive request moves forward.
Editorial analysis by NHI Mgmt Group, based on content published by Riot: “AI Vishing: How It Works, Why Itâs Dangerous, and How to Stop It”.
By the numbers:
- Cisco Talos reported that vishing made up over 60% of all phishing-related incident response engagements in Q1 2025.
- The UC Berkeley study found people could mistake a cloned voice for the real speaker in up around 80% of instances.
- Google's Threat Intelligence Group linked vishing gangs to attacks targeting Apollo, Blackstone, KKR, Bain Capital, and other top financial firms in 2026.
Key questions
Q: Why do vishing attacks still lead to remote access even when MFA is enabled?
A: Because the attacker is not bypassing MFA in a technical sense, they are using social engineering to trigger a legitimate login or recovery flow.
Q: What are the signs that an AI vishing call is trying to bypass controls?
A: The main signs are urgency, secrecy, pressure to skip normal verification, and a request to keep the conversation isolated from colleagues.
A: Voice recognition and caller ID break down because both are easy to spoof or synthesize.
Practitioner guidance
- Adopt out-of-band callback verification for all high-risk requests Require staff to end the call and validate the request through a known directory number before any credential reset, MFA change, or payment approval.
- Add two-person approval for access and payment changes Make credential resets, MFA re-enrollment, wire transfers, and vendor-payment changes require an independent second approver who was not on the original call.
- Restrict what public audio and org data can be used for pretexting Reduce voicemail exposure, review conference recordings, and limit publicly visible role relationships that attackers can use to build convincing impersonations.
Bottom line: AI vishing turns voice trust into a controllable attack surface, and the failure point is the approval process rather than the speech model itself.
Glossary terms: AI Vishing, Callback verification, Two-Person Approval, Activation Trust Gap
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
AI vishing is now an identity-control problem, not a communications nuisance. The attack succeeds by abusing trust decisions that sit inside help desks, finance operations, and executive support workflows. That means the relevant control boundary is not the telephone, but the identity and approval process that the call is trying to hijack. Practitioners should treat voice-based impersonation as a failure mode in human identity governance, especially where privileged requests can be approved in-band.
A few things that frame the scale:
- Voice phishing was the most common initial infection vector in cloud intrusions in 2025 (23%) and the second most common across all intrusions (11%), according to Mandiant's M-Trends 2026.
A question worth separating out:
Q: Should organisations use callback verification or two-person approval for sensitive requests?
A: They should use both for different failure points. Callback verification confirms the caller through an independent channel, while two-person approval reduces the chance that one socially engineered employee can authorize a reset or transfer alone. Together they move trust out of the live call and into auditable process.
👉 Read our full editorial: AI vishing is bypassing instinct and weakening identity controls
This post was modified 6 days ago by NHI Mgmt Group