Voice phishing, or ‘vishing’, uses voice – phone calls, voice messages, deepfake audio clips – to manipulate victims into turning over network access credentials, classified data, or payment authorisation to the criminals.

Like its predecessor, this more sophisticated form of social engineering relies on exploiting emotion and trust. Attackers apply pressure under the pretext of ‘urgency’, relying on typical work behaviours such as multitasking, cognitive overload, tiredness and lapses in concentration, which affect the degree of susceptibility.

2026 has seen twice as many Vishing attacks in the first six months  than  the second half of 2025, according to CrowdStrike’s 2026 Threat Hunting Report. In 2025’s report, CrowdStrike noted a 442% rise in voice-based social engineering attacks over the course of 2024.

Last year, over Easter, three jewels in the UK retailing crown – Marks & Spencer, Co-op and Harrods – were all hit by vishing attacks in quick succession. M&S estimated the breach cost £300m, with the Co-op breach earmarked around £207m.

How vishing works

Those attacks compelled the National Cyber Security Centre (NCSC) to warn that criminals were impersonating IT help desks, phoning up and fooling staff into complying with access requests, or certain instructions.

“A common strategy is to call someone and claim to be the IT department, needing to access their device to resolve an issue,” says Mike Freeman, IT manager at Cambridge-based Costello Medical. “AI can now simulate different voices and personalities very convincingly and this is only becoming more convincing over time,” he warns.

Two forms of vishing currently dominate the landscape:

The ‘Adversary in the Middle’ (AiTM) tactic

In an AiTM attack the phone calls or voice clips direct the victim to a proxy server that mirrors the company’s own, and which captures their live multi-factor authentication details and other access privileges. Cyber criminals similarly impersonate senior executives or colleagues, to trick staff into making financial transactions, or stealing data.

“This is more likely if there are clips containing somebody’s voice online, which can be used to train an AI,” says Freeman.

The ‘TOAD email’ gambit

Vishing is increasingly carried out via Telephone-Oriented Attack Delivery (TOAD), where the attacker sends an innocent-looking email, invoice, or ‘urgent’ message, prompting the victim to call a number to ‘resolve the issue’ or face disaster. Crucially, the initial email will contain no links or characteristics likely to be picked up by phishing email filters and so flies under the cyber security radar. Once the victim responds to the ‘TOAD email’ and makes the call, the attackers begin convincing them to follow instructions or surrender control of their screen.

Increasingly, a combination of AiTM and TOAD is being used, where the impersonator calls in and convinces the victim to access a proxy server set up for the particular breach the attackers have planned.

How to defend against vishing

“Recognise if you are being asked to do something that’s high-risk,” is Freeman’s advice. “For example, [requests] to give information, money, passwords, access, or to click a link, run a code or perform any unfamiliar task on a computer.”

He adds: “Stop and validate if the risk is high. End the call and call back on a known number.

And check with other trusted contacts, for example, another member of your IT team, to see if the call was expected.”

As Freeman alludes, it is evident that, despite increasingly sophisticated cyber security technology, there is arguably a limit to its powers. Cyber crime attacks are mainly successful when they manage to exploite human fallibility and vulnerability, and that is where defences must be strengthened. Organisations would benefit from mapping and assessing their work practices to identify vulnerabilities and determine how best to address them.