We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,258 News Articles

First 'vishing' attack comes to light

Phishing using VoIP telephony

An ingenious type of phishing scam that uses VoIP (voice over IP) telephony to entrap its victims has been reported by Secure Computing.

Known as 'vishing', the fraud involves a randomly dialled user being phoned by an automated system to be told that their credit card has been used illegally.

They are then asked to dial a fake 1-800 telephone number, which accesses a system requesting they confirm their account details and credit card number. Armed with this information, criminals then empty the victim's account by buying products and services on the card.

A clutch of phone-based scams have suddenly come to light in the last month, but this is one of the most advanced for the way it uses the features allowed by VoIP to disarm the suspicions of contacted subjects.

According to Secure Computing, the call return number is spoofed to appear as a regional telephone number of the financial institution the criminals are pretending to represent, a feint that is much easier to pull off on VoIP than it would be on a conventional network. The real VoIP number could be anywhere in the world.

Because the scam is carried out offline, it represents a form of social engineering that no computer security system can stop. Once a credit card customer has fallen for the story – and it is quite possible that the average account holder will be less suspicious of phone contact than they would be of the same message received via email – they are heading for an empty account.

"Like most other social engineering exploits, vishing relies upon the hacking of a common procedure that fits within the victim's comfort zone," said Secure Computing's Paul Henry.

As a matter of course, customers should be highly suspicious of any phone or email contact that does not use their first name and surname, and should never dial a call return number or reply to an email regarding any financial matter.

Significantly, the so-called 'vishing' phenomenon is an example of a growing number of frauds that have first come to light on security discussion groups rather than through detection by security companies.

IDG UK Sites

Black Friday and Cyber Monday 2014 tech deals UK Live: Best Black Friday deals from Apple, Amazon,...

IDG UK Sites

Why are people still buying satnavs? Smartphones are the modern satnav

IDG UK Sites

New Star Wars trailer: Watch the VFX-laden teaser for The Force Awakens

IDG UK Sites

Black Friday 2014 UK: Apple deals, Amazon deals & Black Friday tech offers UPDATED