Topic starter
24/06/2026 10:04 pm
TL;DR: Vishing uses voice, caller ID spoofing, and urgency to extract passwords, PINs, and financial or personal data, making it harder to spot than email phishing, according to 1Kosmos. The real failure is not awareness alone but identity verification that can withstand a persuasive live call.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “Understanding Vishing: What It Is & How to Protect Yourself”.
Key questions
Q: What breaks when identity decisions depend on a live phone call?
A: Caller trust becomes a security control, and that control is weak because attackers can spoof numbers, imitate authority, and steer the conversation in real time.
Q: Why do AI voice phishing attacks bypass many existing security controls?
A: They bypass controls because many controls authenticate messages, not human intent.
Q: What are the signs that a phone-based impersonation attempt is in progress?
A: Common signs include unexpected urgency, pressure to share credentials or one-time codes, caller ID that claims to be from a trusted organisation, and a request to bypass normal verification steps.
Practitioner guidance
- Harden account recovery calls Require independent verification before any password reset, code re-issuance, or profile change is accepted from a caller claiming to be a user or employee.
- Separate caller trust from caller ID Treat inbound phone numbers as routing hints only and validate the request through a known, out-of-band callback path or authenticated portal.
- Remove sensitive prompts from live calls Prohibit staff from collecting passwords, PINs, or one-time codes during calls, because those details can be elicited by a convincing impersonator.
Bottom line: Voice phishing succeeds because social pressure and spoofed caller identity can override normal verification habits.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 6:51 am
Vishing is not a channel problem, it is a caller-verification problem. The article shows that voice calls remain effective because people still treat a persuasive live interaction as evidence of identity. That assumption is fragile in any environment where access or recovery decisions are made under pressure. The practitioner conclusion is simple: if a phone call can establish trust, then the identity model is too weak for high-risk workflows.
A few things that frame the scale:
- Voice phishing was the most common initial infection vector in cloud intrusions in 2025 (23%) and the second most common across all intrusions (11%), according to Mandiant's M-Trends 2026.
A question worth separating out:
Q: How should organisations verify identity during account recovery and support calls?
A: They should use a separate verification path that does not depend on information disclosed during the call. That usually means a known callback route, an authenticated portal, or a pre-registered recovery method. The caller should never be allowed to prove identity simply by sounding convincing or repeating private details.
👉 Read our full editorial: Vishing is still a human identity problem, not just a scam