Every example below follows the same pattern: a trusted identity, a reason to hurry, and a request that skips the normal check. Each ends with the sign that gave it away.
“We're seeing failed sign-ins on your account. I'll send a code to lock it; can you read it back to me?”
The help desk never needs your code.
Hang up, call the help desk on the number on the intranet.
“We're moving to a new provider and your bank details didn't transfer. Can you confirm them now so you're paid on Friday?”
A payroll change requested by phone.
Change details only in the HR system.
“I've got a parcel for your office but the address is incomplete. Can you confirm the building access code?”
A stranger asking for a physical access detail.
Refer them to reception.
“Our bank has changed; please update our details before this month's invoice.”
New payment details by phone.
Verify on the number already on file.
“I'm about to board. I need this payment approved in the next ten minutes; I'll explain later.”
Urgency plus secrecy.
Verify on a second channel, however senior the voice.
The same executive request, in the executive's own voice, cloned from a conference talk.
The request, not the voice.
The same callback rule.
Attackers reportedly researched an employee on LinkedIn, called the IT help desk pretending to be that person, and talked their way into a password reset.
Source: CBS News, TechCrunch.
After a text message led an employee to a fake login page, an attacker called them posing as IT staff. Retool says the caller used a deepfaked voice, and the employee handed over a one-time code.
Source: Retool's incident write-up.
Attackers took an employee's password from their personal Google account, which was syncing saved passwords. They then made repeated voice phishing calls, posing as support organisations the employee trusted, and sent MFA push requests until one was approved, which gave them VPN access.
Source: Cisco Talos.
A finance employee in Hong Kong transferred about US$25 million after a video call on which, according to Hong Kong police, the other participants, including the CFO, were deepfakes.
Source: CNN, May 2024, CNN, February 2024.
Reading examples helps; hearing one helps more. A vishing simulation calls your employees with scenarios like these, with their consent, and shows each one what gave the call away.
