Man in a white t-shirt talking on a cellphone by a window, looking outward with a thoughtful expression in a dim hallway.

When the Call Sounds Legit, But Isn’t

4 min read

Your phone rings. The caller identifies themself as a representative of your bank. They sound professional and tell you there has been suspicious activity on your account.

They know your name. They may even know the last few digits of your account or card. Then comes the request: “We need to verify a few details to secure your account.”

The whole conversation feels completely legitimate. But what if it isn’t? You could be the target of a vishing attack.

Vishing, short for voice phishing, is a type of scam in which criminals use phone calls to impersonate trusted individuals or organisations to try and steal your personal information, account credentials or money.

These scams are becoming more sophisticated, so it is increasingly important to know not only what to look for, but how to respond.

What makes vishing so convincing?

Vishing works because scammers use trust, urgency and information to make their approach believable.

In some jurisdictions, scammers are increasingly using caller ID spoofing. This allows them to manipulate the information displayed on your phone, making a call appear to come from a bank, business, government agency or even a local number.

Scammers may also use information about you that is already available online or has been obtained through previous scams or data breaches.

Criminals are also now using AI-generated or cloned voices to make impersonations more convincing, adding another layer of credibility to a fraudulent call.

Tactics to watch for

Vishing scams can take different forms, but several patterns are becoming increasingly common.

The “fraud alert” call
You receive a call about a suspicious transaction or alleged compromise of your account. The caller says they are helping you secure your funds, but the real goal is to get your account information, passwords or verification codes.

The “transfer to another department” trick
The first caller may pretend to be from your bank and then transfer you to another person who claims to be from the fraud department, security team or another trusted organisation. The handoff is designed to make the story feel more authentic.

The “verify your identity” request
The caller may already have some information about you and ask you to confirm the rest, such as your password, PIN, card details or a one-time verification code. Providing the missing pieces can give a scammer what they need to access your accounts.

The “stay on the line” tactic
Scammers may discourage you from hanging up, contacting your bank independently or speaking with someone you trust. Creating a sense of urgency or secrecy makes it harder to stop and think.

Red Flags

A call deserves extra scrutiny when the person:

Uses a sense of authority to create urgency: “You need to act right now.”
Uses fear: “Your account has been compromised.”
Asks for confidential information such as passwords, PINs, full card details or verification codes.
Asks you to move money particularly to another account to “protect” it.
Tells you not to hang up or discourages you from contacting the bank yourself.
Insists on secrecy: “Don’t tell anyone about this.”
Asks you to download software or provide remote access to your phone or computer.

What should you do if you receive a suspicious call?

Pause. Don’t let the caller set the pace.
If something feels unusual, take a moment. You do not have to solve the problem while you are on the phone.
Don’t provide confidential information.
Never share passwords, PINs or one-time verification codes with an unexpected caller. Do not provide information simply because the caller already knows some details about you.
Hang up.
You don’t need to stay on the line to be polite or to prove that you are cooperative.
Verify independently.
If the caller says they are from your bank, contact the bank yourself using a trusted channel such as the official website, mobile app, or contact centre. Do not use the number provided by the caller or rely on the number displayed on your caller ID.
Tell someone.
If the call leaves you uncertain, speak with someone you trust before acting. A second perspective can help you recognise red flags that you may have missed or are difficult to see while you are caught up in the moment.

Already responded to a suspicious call?

Don’t panic. Act quickly.

If you shared information, provided a verification code, gave someone access to your device or moved money because of a suspicious call, contact your bank immediately through an official channel. Explain exactly what happened and follow the bank’s instructions to secure your account.

The sooner you report a suspected compromise, the sooner steps can be taken to protect you.