Vishing and Smishing Guide

Phone calls and text messages bypass the email filtering most security programmes are built around, and a convincing caller can talk a help desk into resetting the one account that unlocks everything. Voice phishing (vishing) and SMS phishing (smishing) sit behind several major enterprise intrusions of recent years and behind high-volume toll and parcel scam texts. This guide covers how pretext calls, callback phishing, help desk impersonation, caller ID and sender ID spoofing, SMS blasters and AI voice cloning work at technique level, then sets out the verification procedures, technical controls, detections and metrics that reduce the risk. It is written for security, IT service and fraud teams. Email phishing is covered in the Phishing Guide.

Key takeaways

• The help desk is the primary target. CISA and the FBI describe Scattered Spider convincing "IT help desk personnel to reset passwords and/or MFA tokens"; reset and re-enrolment requests need verification that a caller cannot talk past.
• Caller ID and sender ID prove nothing. ATT&CK notes that voice phishers "may spoof their phone number"; regulators are narrowing spoofing, but no organisation should treat a displayed number as identity.
• Verify out of band, on a channel you choose. Call back on a number of record, require a second approver and never act on details supplied in the call or message itself; this also defeats AI voice clones.
• Make a phished code worthless. Phishing-resistant MFA, allowlisted remote access tools and restricted OAuth app approval mean a successful call still yields nothing usable.
• Smishing defence is mostly structural. Most smishing domains live for days, so takedown is too slow; managed mobile protection, removal of SMS codes, published "we never text links" policies and fast reporting to 7726 or IC3 do more.

How vishing and smishing attacks work

ATT&CK describes voice phishing in two places. Spearphishing Voice for initial access (T1566.004) covers calls that lead a victim to install remote management tools or approve MFA prompts, and messages that "instruct them to call a phone number". Phishing for Information: Spearphishing Voice (T1598.004) covers calls that elicit information, made manually, through hired call centres or by robocall, often posing as a business partner or technical support. Smishing is part of Mobile Phishing (T1660), alongside QR code phishing and calls placed to mobile users. The FBI defines vishing as targeting "using voice memos" that "may incorporate AI-generated voices".

Enterprise intrusions

The joint CISA and FBI advisory on Scattered Spider (AA23-320A) describes a group that targets large companies and their contracted IT help desks, poses as IT staff by phone or text to obtain credentials or get employees to run remote access tools, uses smishing and SIM swapping, and floods users with MFA prompts. ATT&CK adds that the group phoned employees and steered them to adversary-in-the-middle login pages, and that LAPSUS$ "called victims' help desk to convince the support personnel to reset a privileged account's credentials". The MGM Resorts breach began with a help desk call, and the ShinyHunters Salesforce campaign used phone calls to get malicious connected apps approved.

Consumer-scale smishing

Unit 42 attributes over 194,000 malicious domains registered since January 2024 to the Smishing Triad operation. Tolls are the most impersonated category and the US Postal Service the most impersonated brand, with banks, tax authorities, vehicle agencies and crypto exchanges also impersonated. About 29% of domains were active for two days or less. The FBI's April 2024 toll alert recorded over 2,000 complaints since early March, with sender numbers changing from state to state. These campaigns matter to enterprises in two ways: staff use the same phones for work sign-in, and any organisation whose brand is impersonated carries the customer support and fraud cost.

Why the phone channel is hard to trust

• Caller ID spoofing: STIR/SHAKEN in the US has originating carriers digitally sign caller ID so downstream carriers can validate it and label or block spoofed calls, according to the FCC. In the UK, Ofcom's strengthened CLI guidance expects providers to "identify and block calls from abroad that use a UK number as a Presentation Number", and a later statement extends this to calls from abroad presenting UK mobile (+447) numbers. Both reduce spoofing; neither authenticates the person speaking, and calls from compromised or rented genuine numbers pass.
• Sender ID: SMS can carry an alphanumeric sender name rather than a number, which a recipient cannot verify. Smishing Triad moved from email-to-SMS and iMessage delivery to ordinary phone numbers, many with +63 and a growing share with +1 prefixes.
• Messaging outside the carrier filter: iMessage and RCS travel over data, so carrier SMS spam filtering does not inspect them in the same way.
• SMS blasters: these "mimic a mobile base station to trick nearby phones into connecting", exploit weak authentication in 2G and deliver texts that never pass operator filtering. Arrests have been reported in the UK, Brazil, Thailand, Indonesia, New Zealand and elsewhere. Android 12 and later lets users disable 2G; on iPhone, Lockdown Mode disables 2G.
• Synthetic voices: the FBI warned in May 2025 of text and AI-generated voice messages impersonating senior US officials to build rapport and move targets to another platform, noting that cloned voices can sound nearly identical to real contacts. The Arup deepfake fraud shows the same technique on a video call. See the Deepfake and AI Impersonation Guide.

Help desk verification

After the 2025 UK retail incidents the NCSC asked organisations to review "how the helpdesk authenticates staff members credentials before resetting passwords", "especially those with escalated privileges". The principle is that verification strength must match what the request grants, and that knowledge a caller can research (employee number, manager's name, date of birth) is not verification. The Co-op and Marks and Spencer attacks show the cost when it is. See the Account Recovery and Help Desk Security Guide.

• Script the refusal: agents need written authority to say no to urgency, seniority and anger, and a no-blame escalation path. Attackers rely on agents wanting to help.
• Remove the reason to call: self-service recovery with a second registered phishing-resistant authenticator removes most legitimate reset calls, so the remaining ones stand out.
• Outsourced desks: the same procedures, logging and refusal authority must apply in contracted service desks, which AA23-320A names as targets.

Protecting employees from inbound calls and texts

• Publish how IT will contact staff: state that IT never asks staff to read out codes, install remote access tools or approve prompts by phone, and give one internal number to verify any call.
• Phishing-resistant MFA: AA23-320A recommends FIDO/WebAuthn or PKI-based MFA, which it says is "not suspectable to push bombing or SIM swap attacks". A vished OTP or approved push is then useless. See the MFA Fatigue and Bypass Guide.
• Control remote access tools: CISA recommends application controls that allowlist approved remote access software, including portable versions, audits of the tools present, and remote access only through approved VPN or VDI.
• Restrict app approval: require admin consent for new OAuth or connected apps so a caller cannot talk a user into authorising one.
• Managed mobile protection: ATT&CK mitigation M1058 notes that mobile security products can inspect traffic and block known phishing sites; on managed Android devices, disable 2G where the MDM supports it.
• SIM swap resilience: ATT&CK T1451 recommends monitoring SIM changes through MDM (M1012), carrier account PINs and non-SMS authentication (M1011). Remove SMS codes for workforce accounts.

Payment and high-risk action verification

Vishing often ends in a payment request rather than a login. The controls are procedural, and they are the same whether the voice is a human impostor or a clone.

1. Never act on contact details in the request: new or changed bank details are confirmed by calling the supplier on a number already held, not one in the message, email signature or call.
2. Dual approval: payments and supplier bank changes above a threshold need a second approver who did not receive the request.
3. Challenge phrases: the FBI suggests families agree a secret word; for executives and finance staff, a pre-agreed verification phrase or call-back rule serves the same purpose.
4. Cooling-off for urgency: any request marked confidential or urgent from a senior figure triggers verification, not speed.

See the Authorised Push Payment (APP) Fraud Guide.

Smishing controls for organisations with customers

• Publish what you never send: tell customers which channels you use and that you never text payment links or ask for codes, so the lure stands out.
• Reporting routes: in the UK, customers can forward suspicious texts free to 7726 so the provider "can investigate the origin of the text and arrange to block or ban the sender"; losses go to Action Fraud or Police Scotland. In the US, the FBI asks for reports to ic3.gov with the sending number and URL.
• Domain monitoring with realistic expectations: with most smishing domains short lived, monitoring for look-alike registrations feeds blocklists and warnings faster than takedown requests remove sites.
• Do not rely on SMS for authentication: NIST SP 800-63B-4 states that out-of-band and OTP authentication are "not phishing-resistant"; offer passkeys to customers. See the Passwordless and Passkeys Guide.

Choosing controls

• Video verification or in-person checks: video with ID is scalable for remote workforces but must allow for deepfakes, so pair it with HR photo comparison and a callback. In-person checks are strongest but only practical where staff are on site.
• Training or technical controls: training reduces the click and the call-back but will not hold against a skilled caller every time. Prioritise controls that make success worthless: phishing-resistant MFA, remote tool allowlisting and app consent restrictions. See the Security Awareness and Human Risk Management Guide.
• Small organisations: one written rule (no resets, payments or bank changes on inbound contact, always call back on a known number), phishing-resistant MFA for email and admin accounts, and a single reporting address covers most of the risk.
• Large organisations: tiered help desk verification, a separate privileged support queue, call recording and ticket correlation in the SIEM, and contract clauses that bind outsourced desks to the same procedures.

How to implement

1. Map the reset paths: list every way a password, MFA method, device or SIM can be changed, including outsourced desks and supplier portals.
2. Close the privileged path first: stop phone resets for administrators and executives and introduce in-person or video verification with second-person approval.
3. Pilot tiered verification with one service desk team for a month, measuring call handling time and abandoned resets, then roll out.
4. Deploy technical backstops: phishing-resistant MFA, remote access tool allowlisting in audit mode then enforce, and admin consent for apps.
5. Test: run authorised vishing exercises against the help desk and finance, with scripts approved in advance and results used for coaching, not discipline.
6. Roll back with care: if verification delays cause business harm, add capacity or self-service rather than weakening a tier; any exception is time limited and owned.

Detection and measurement

Vishing leaves traces across the service desk, identity provider and endpoint rather than in one log. ATT&CK detection strategies DET0245 and DET0886 recommend monitoring corporate call logs and VoIP or SIP records for unusual numbers and correlating calls with MFA push activity.

Metrics that show the programme is working:

• Verification compliance: percentage of MFA and privileged resets completed with the required tier, from ticket sampling.
• Exercise outcome: rate at which test vishing calls are refused and reported, by team.
• Report time: median minutes from a suspicious call or text to a report reaching the SOC.
• SMS dependence: number of workforce accounts still using SMS or voice codes.
• Payment holds: count of payment or bank change requests stopped by callback verification.

Responding to a successful call or text

Staff who realise they were deceived must be able to report without blame, because minutes matter. Treat a reported vishing or smishing success as an identity incident first. See the Incident Response Guide.

1. Contain the identity: revoke the user's sessions and refresh tokens, reset the password and remove any authenticator, device or OAuth app added since the call.
2. Check the endpoint: look for remote management tools installed or run during the call and isolate the device if one is found.
3. Check the number: if SMS codes stopped arriving or the phone lost signal, contact the carrier about a SIM swap or port-out and move the account off SMS.
4. Find the campaign: search call logs, help desk tickets and SMS reports for the same number, pretext or link, and warn targeted teams.
5. Stop the money: if a payment was made, contact the bank immediately for recall and report the fraud (Action Fraud or Police Scotland in the UK, IC3 in the US).

Framework mapping

Common failure patterns

• Knowledge-based verification at the help desk: employee IDs and managers' names are discoverable; the MGM Resorts call shows how little is needed.
• Same rules for every account: privileged and executive resets handled like standard ones, so the most valuable accounts are the easiest to take.
• SMS codes left as a fallback: smishing and SIM swap both target them; the Twilio breach began with texts to employees.
• Remote access tools unrestricted: any user can install a remote support tool when a "helpful" caller asks; the Cisco breach combined voice phishing with push fatigue to reach the VPN.
• Trusting a familiar voice or face: payment approved because the caller sounded right, with no callback.
• Training without reporting: staff recognise the call but have no quick way to report it, so the SOC never sees the campaign.

Practitioner checklist

• Define tiered help desk verification and ban resets of privileged accounts on inbound calls.
• Apply the same procedures and refusal authority to outsourced service desks.
• Publish how IT, finance and the organisation contact staff and customers, and what they never ask for.
• Replace SMS and voice codes with phishing-resistant MFA, starting with administrators.
• Allowlist remote access tools and require admin consent for new OAuth apps.
• Require callback on a number of record and dual approval for payments and bank detail changes.
• Disable 2G and monitor SIM changes on managed mobile devices.
• Correlate help desk tickets with identity logs and alert on reset-then-register sequences.
• Run authorised vishing exercises against the help desk and finance twice a year.
• Give staff and customers one-step reporting routes, including 7726 and IC3.

Standards and references

• CISA and FBI: Scattered Spider advisory AA23-320A
• NCSC: Incidents impacting retailers, recommendations from the NCSC
• NCSC: Report a scam text message
• FBI IC3: Senior US Officials Impersonated in Malicious Messaging Campaign
• Ofcom: Tackling scam calls from abroad
• MITRE ATT&CK: T1566.004 Phishing: Spearphishing Voice
• MITRE ATT&CK: T1598.004 Phishing for Information: Spearphishing Voice
• Palo Alto Networks Unit 42: Smishing Triad global smishing campaign

Related NHI Mgmt Group resources: Account Recovery and Help Desk Security Guide · Security Awareness and Human Risk Management Guide · Authorised Push Payment (APP) Fraud Guide · Phishing Guide · Deepfake and AI Impersonation Guide