Vishing (Voice Phishing)
Vishing, short for voice phishing, is social engineering carried out over a phone call, in which an attacker impersonates a trusted party to get the target to reveal credentials, approve a sign-in, or reset an account.
In identity attacks the call usually has one of two goals: persuade a help desk to reset a password or MFA method for an account the attacker names, or persuade an employee to enter credentials or a one-time code into a lookalike sign-in page while the caller relays them. Groups such as Scattered Spider and ShinyHunters have used it to reach SSO accounts and then the SaaS data behind them, and attackers have used passkey rollouts themselves as the pretext. The controls are procedural as much as technical: verified callback and identity checks before any help-desk reset, a published rule that IT never asks for codes or credentials by phone, and phishing-resistant MFA that a relayed session cannot satisfy.
See also: help-desk social engineering, OTP relay social engineering, account takeover, Scattered Spider, Calling Name Presentation (CNAP), smishing
Related on Start with Identity
- GlossaryMFA Fatigue
MFA fatigue, also called push bombing, is an attack in which someone who already has a user's password triggers push approval prompts over and over until the us
- GlossaryBrowser-in-the-Browser (BitB)
Browser-in-the-browser (BitB) is a phishing technique in which a web page draws a fake browser popup window, complete with title bar, address bar and padlock, o
- GlossarySIM Swap
A SIM swap is an attack in which a criminal gets a victim's mobile number moved to a SIM or eSIM they control, usually by deceiving or bribing mobile carrier st
- BlogEntra ID stops delivering SMS and voice codes on February 1, and global admins go last
From February 1, 2027, Microsoft stops providing SMS and voice authentication in Entra ID, and users with no other method must register a passkey to keep signin
- ReportPhishing-Resistant MFA Support Matrix 2026
54% of 95 business SaaS apps support passkeys or security keys, but only 13% let admins require them, and 60% of apps with a documented SSO plan charge more for
- Blog46.5% of 2025-2026 identity breaches had no login for MFA to protect
SWI's Identity Breach Report 2026 classified 115 identity breaches from 2021 to October 2026. Where MFA status is known it was bypassed in 25 of 40 cases, and i