Topic starter
20/08/2026 6:11 pm
TL;DR: Vishing has moved beyond simple phone scams: attackers now combine VoIP, caller ID spoofing, and AI voice cloning to impersonate executives and vendors, making legacy annual awareness training too slow to counter modern social engineering, according to Living Security Human Risk Management Platform. The real governance gap is verification discipline, not employee intelligence, because trust in voice and caller ID is no longer a reliable security control.
Editorial analysis by NHI Mgmt Group, based on content published by Living Security Human Risk Management Platform: “How to Spot and Prevent a Vishing Social Engineering Attack”.
Key questions
Q: What breaks when organisations trust caller ID or voice as proof of identity?
A: Caller ID and voice are no longer reliable identity signals because both can be spoofed or cloned.
Q: Why do AI voice cloning attacks create more risk than ordinary phone scams?
A: They remove many of the cues people use to judge authenticity.
Q: What do security teams get wrong about vishing prevention?
A: They often treat it as an awareness problem alone.
Practitioner guidance
- Define a mandatory out-of-band verification rule Require staff to hang up and call back using an independently sourced contact number before acting on any unexpected request for credentials, payments, or access changes.
- Remove voice as an authentication signal Prohibit callers, even apparent executives, from being treated as verified identities for password resets, payment approvals, or help desk escalation.
- Build vishing scenarios into continuous training Use targeted micro-training and simulations that reflect caller ID spoofing, executive impersonation, and AI voice cloning rather than one annual awareness module.
Bottom line: Vishing now behaves like an identity impersonation problem, because attackers can combine spoofed numbers, VoIP, and AI voice cloning to defeat trust-based checks.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:46 pm
Vishing has moved from a human error problem to an identity verification problem. The article shows that the decisive weakness is not whether employees have heard of phishing, but whether the organisation has a reliable way to verify a request that arrives by voice. Once AI voice cloning and caller ID spoofing are in play, voice becomes an untrusted signal. Practitioners should treat any inbound voice request as a claim that must be verified, not as evidence of identity.
A few things that frame the scale:
- Voice phishing was the most common initial infection vector in cloud intrusions in 2025 (23%) and the second most common across all intrusions (11%), according to Mandiant's M-Trends 2026.
A question worth separating out:
Q: How should organisations govern phone-based requests that affect access or money?
A: They should treat those requests as high-risk transactions, not casual conversations. That means independent callback verification, clear approval boundaries, and logging of exceptions for recovery, payment, and access changes. When a request affects identity, privilege, or funds, the process should require a second trusted channel before it can proceed.
👉 Read our full editorial: Vishing now blends AI voice cloning, spoofing, and human risk