First ‘vishing’ attack surfaces

Secure Computing has reported an ingenious new type of phishing scam that uses VOIP telephony to entrap its victims.

Dubbed “vishing”, the fraud sees a randomly dialled user phoned by an automated system to be told that their credit card has been used illegally.

They are then asked to dial a fake 1-800 telephone number, which accesses a system requesting they confirm their account details and credit card number. Armed with this information, criminals then empty the victim’s account by buying products and services on the card.

A clutch of phone-based scams have suddenly come to light in the last month, but this one is one of the most advanced for the way it uses the features allowed by VOIP to disarm the suspicions of contacted subjects.

According to Secure Computing, the call return number is spoofed to appear as a regional telephone number of the financial institution the criminals are pretending to represent, a feint that is much easier to pull off on VOIP than it would be on a conventional PSTN. The real VOIP number could be anywhere in the world.

Because the scam is carried out offline, it represents a form of social engineering that no computer security system can stop. Once a credit card customer has fallen for the story – and it is quite possible that the average account holder will be less suspicious of phone contact than they would be of the same message received via email – they are heading for an empty account.

“Like most other social engineering exploits, vishing relies upon the hacking of a common procedure that fits within the victim’s comfort zone,” said Secure Computing’s Paul Henry.

As a matter of course, customers should be highly suspicious of any phone or email contact that does not use their first- and surnames, and should never dial a call return number of reply to an email regarding any financial matter.

Significantly, the so-called “vishing” phenomenon is an example of a growing number of frauds that have first come to light on security discussion groups rather than through detection by security companies.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Featured Articles

Cybersecurity in 2024: Priorities and challenges for Canadian organizations 

By Derek Manky As predictions for 2024 point to the continued expansion...

Survey shows generative AI is a top priority for Canadian corporate leaders.

Leaders are devoting significant budget to generative AI for 2024 Canadian corporate...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now