We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

First 'vishing' attack comes to light

Phishing using VoIP telephony

An ingenious type of phishing scam that uses VoIP (voice over IP) telephony to entrap its victims has been reported by Secure Computing.

Known as 'vishing', the fraud involves a randomly dialled user being phoned by an automated system to be told that their credit card has been used illegally.

They are then asked to dial a fake 1-800 telephone number, which accesses a system requesting they confirm their account details and credit card number. Armed with this information, criminals then empty the victim's account by buying products and services on the card.

A clutch of phone-based scams have suddenly come to light in the last month, but this is one of the most advanced for the way it uses the features allowed by VoIP to disarm the suspicions of contacted subjects.

According to Secure Computing, the call return number is spoofed to appear as a regional telephone number of the financial institution the criminals are pretending to represent, a feint that is much easier to pull off on VoIP than it would be on a conventional network. The real VoIP number could be anywhere in the world.

Because the scam is carried out offline, it represents a form of social engineering that no computer security system can stop. Once a credit card customer has fallen for the story – and it is quite possible that the average account holder will be less suspicious of phone contact than they would be of the same message received via email – they are heading for an empty account.

"Like most other social engineering exploits, vishing relies upon the hacking of a common procedure that fits within the victim's comfort zone," said Secure Computing's Paul Henry.

As a matter of course, customers should be highly suspicious of any phone or email contact that does not use their first name and surname, and should never dial a call return number or reply to an email regarding any financial matter.

Significantly, the so-called 'vishing' phenomenon is an example of a growing number of frauds that have first come to light on security discussion groups rather than through detection by security companies.

IDG UK Sites

Best camera phone of 2015: iPhone 6 Plus vs LG G4 vs Galaxy S6 vs One M9 vs Nexus 6

IDG UK Sites

In defence of BlackBerrys

IDG UK Sites

Why we should reserve judgement on Apple ditching Helvetica in OS X/iOS for the Apple Watch's San...

IDG UK Sites

Retina 3.3GHz iMac 27in preview: Apple cuts £400 of price of Retina iMac with new model