A one ring scam is a phone fraud that uses a missed call to lure someone into calling back a premium-rate or fraudulent number. The technique, also called wangiri, relies on caller curiosity and short-lived calls, then monetises return calls through chargeable connections or identity capture.
What the scam is really exploiting
One ring scams work because the call itself is not the product, the callback is. The brief missed call is designed to trigger curiosity, urgency, or concern, then push the target into returning the call to a number that monetises time, connection fees, or other fraudulent charges.
That makes the scheme deceptively simple. The attacker does not need to keep the line open for long, only long enough to create a reason to call back. In practice, the scam can be scaled across large call lists, often using short-duration bursts that are easy to automate and hard for a target to judge in the moment.
How wangiri works as a fraud pattern
Wangiri is a classic callback fraud pattern. The tactic depends on behavioural manipulation rather than technical compromise, so the fraud often survives even when users are cautious about links, attachments, and obvious phishing messages. The missed-call format gives it a veneer of legitimacy because many people expect some unknown calls to be important.
The fraud can also be adapted across regions and telecom arrangements. Some campaigns rely on premium-rate services, while others route victims through fraudulent or chargeable international destinations. The common feature is that the attacker profits once the victim initiates contact, turning the target’s own return call into the delivery mechanism.
Why this scam remains effective
One ring scams exploit two familiar human reactions: curiosity and risk aversion. A short missed call can feel too insignificant to investigate thoroughly, yet just important enough to prompt a callback. That small decision point is what the fraud depends on.
The scam is also effective because it moves quickly. The original call disappears before the victim can inspect it properly, and the harm may not be obvious until after charges appear. In that sense, the attack is less about forcing access than about engineering a voluntary, monetisable response.
What organisations and individuals should look for
Exposure is usually visible in call records, telecom billing anomalies, and repeated missed calls from unfamiliar or international numbers. For organisations, the concern is not only direct cost but also employee distraction and the possibility that a scam pattern is being used at scale against a population. For individuals, a single missed call is not evidence of legitimacy.
Good practice is to verify unknown callers through a separate trusted channel, especially when the number is foreign, withheld, or repeatedly appears in short bursts. If a return call is necessary, it should be made only after checking whether the number is associated with a known business, supplier, or contact path. Telecom providers and enterprise mobile teams can also help by monitoring charge anomalies and blocking known abusive ranges where available.
Risk and Threat Considerations
One ring scams create direct financial exposure, but the broader risk is behavioural: they convert a harmless-looking missed call into an action that benefits the attacker. Because the technique is fast and low cost, campaigns can be repeated at scale until enough people return the call.
Failure mechanism: The scam relies on the target making the callback, which can trigger premium charges, fraudulent routing, or further social engineering after the connection is established.
Impact: Victims can incur unexpected charges, and in some cases the callback can expose additional personal or operational information if the fraudulent line is used to collect it.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Supports controlling communication channels and misuse exposure around unexpected contact points. |
| Recommendation — Monitor anomalous call-related abuse and block known fraudulent ranges where telecom controls permit. | ||
| NIST CSF 2.0 | PR.AA-01 — Identities and credentials are issued, managed, verified, revoked, and audited for authorized users, devices, and services. | Supports verifying trusted contact paths before acting on inbound communication. |
| Recommendation — Verify contact legitimacy before responding to unknown numbers or callback requests. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Supports limiting exposure from untrusted communication paths and validating return-call actions. |
| Recommendation — Require independent validation before staff use unknown callback numbers. | ||
Practitioner Guidance
What to watch for: Treat repeated missed calls from unknown numbers, especially very short calls, as a pattern to verify rather than a signal to respond immediately. In organisations, this is a useful awareness topic because the cost is often small per event but can become meaningful when the scam is distributed broadly.
Practitioner takeaway: The safest default is simple, do not return an unknown missed call until the number has been independently validated.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 24, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org