We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,258 News Articles

First 'vishing' attack comes to light

Phishing using VoIP telephony

An ingenious type of phishing scam that uses VoIP (voice over IP) telephony to entrap its victims has been reported by Secure Computing.

Known as 'vishing', the fraud involves a randomly dialled user being phoned by an automated system to be told that their credit card has been used illegally.

They are then asked to dial a fake 1-800 telephone number, which accesses a system requesting they confirm their account details and credit card number. Armed with this information, criminals then empty the victim's account by buying products and services on the card.

A clutch of phone-based scams have suddenly come to light in the last month, but this is one of the most advanced for the way it uses the features allowed by VoIP to disarm the suspicions of contacted subjects.

According to Secure Computing, the call return number is spoofed to appear as a regional telephone number of the financial institution the criminals are pretending to represent, a feint that is much easier to pull off on VoIP than it would be on a conventional network. The real VoIP number could be anywhere in the world.

Because the scam is carried out offline, it represents a form of social engineering that no computer security system can stop. Once a credit card customer has fallen for the story – and it is quite possible that the average account holder will be less suspicious of phone contact than they would be of the same message received via email – they are heading for an empty account.

"Like most other social engineering exploits, vishing relies upon the hacking of a common procedure that fits within the victim's comfort zone," said Secure Computing's Paul Henry.

As a matter of course, customers should be highly suspicious of any phone or email contact that does not use their first name and surname, and should never dial a call return number or reply to an email regarding any financial matter.

Significantly, the so-called 'vishing' phenomenon is an example of a growing number of frauds that have first come to light on security discussion groups rather than through detection by security companies.

IDG UK Sites

Spotify launches on PS4 as Tidal arrives on Sonos: It's Tidal vs Spotify music streaming

IDG UK Sites

It's World Backup Day 2015! Don't wait another minute: back up now

IDG UK Sites

Get the free Adobe Comp CC iPad app for rapid layout design

IDG UK Sites

New 13-inch Retina MacBook Pro (early 2015, 2.7GHz) review: Just about the greatest upgrade any...