Vishing is phishing carried out over a phone call. A scammer calls pretending to be your bank, a support desk, a delivery company, or a government official, and uses pressure to make you share a code, move money, or install an app. The name is “voice” plus “phishing,” and it is dangerous because a live human on the line feels harder to doubt than a text.
Why a phone call is so persuasive
A real person can react to your hesitation, answer your questions, and keep you talking. That is exactly why vishing works. The caller sounds calm and official, quotes a few real details about you to build trust, and then introduces fear: your account is compromised, a case has been filed, a payment is about to go through. In that state, people share things they never would over email.
Two modern tools make it worse. Caller IDs can be spoofed to display a genuine bank or government number, and AI voice cloning can imitate a familiar voice from a few seconds of audio. Neither a number nor a voice is proof of who is calling.
Common vishing scenarios
- Fake bank or card support. “We detected fraud on your card, confirm the OTP we just sent to secure it.” The OTP actually authorizes their transaction.
- Fake tech or app support. A caller claims your account or device has a problem and asks you to install AnyDesk or a similar remote-access app, which hands them control.
- Fake officials. A caller posing as police, customs, or a regulator threatens arrest unless you “verify” by transferring money. This is the digital arrest scam.
- Fake customer care. You search for a helpline, reach a fake support number, and are walked into a payment or a code.
The warning signs
- Urgency or fear created quickly: arrest, account freeze, a payment you must stop now.
- A request for an OTP, PIN, CVV, or password. Real staff never need these.
- Instructions not to hang up, not to tell family, or not to visit your branch. Isolation is a scam tactic.
- A request to install an app or share your screen.
- A demand to move money to a “safe account” for verification. No such thing exists.
How to shut a vishing call down
- Hang up. You are never rude for ending a suspicious call.
- Do not share any code or detail, no matter how official the caller sounds.
- Call back on a number you find yourself, from the official app, website, or the back of your card. Not a number the caller gave you.
- Never install an app or share your screen because a caller asked you to.
- Take your time. A real institution will let you verify independently.
If a caller knew your name, address, or Aadhaar, that does not prove they are genuine. Personal data leaks through breaches, and scammers buy it to sound convincing.
If you already shared something
- Call your bank on an official number and freeze the card or account.
- Change any password or code you revealed, from a trusted device.
- Report the fraud quickly so a transfer can potentially be stopped. Our guide on how to report cybercrime online walks through it.
When you are not sure
If a call leaves you uneasy, you can review the story before you act. Forward the suspicious SMS that came with it, or the number, or a screenshot, to Kaval on WhatsApp. Depending on the item and available checks, it can help you examine the claim, signals, and safer next steps. It is free to start; see the pricing page for current terms.
Vishing is the phone-call cousin of phishing and smishing. Same trick, different channel. The defense is always the same: verify through a channel you chose, never one they handed you.
Frequently asked questions
What is vishing? Vishing is phishing done over a phone call. A scammer calls pretending to be your bank, a support agent, the police, or a government office, and pressures you into sharing an OTP or password, moving money, or installing an app. The word combines voice and phishing.
How do I know if a call is a vishing scam? Warning signs include a caller creating urgency or fear, asking for an OTP, PIN, or card details, telling you not to hang up or talk to anyone, or asking you to install a screen-sharing app. No genuine bank or agency does these things.
Can scammers fake a caller ID or a voice? Yes. Caller IDs can be spoofed to show a bank or official number, and AI voice cloning can imitate a familiar voice. Never treat a number or a voice as proof. Verify by calling back on an official number you find yourself.
What should I do if I get a suspicious call? Hang up. Do not share any codes or details. Call the organization back using a number from their official app, website, or the back of your card, not a number the caller gave you. If you already shared details or money, report it immediately.