Vishing Statistics 2026: Unmasking the Voice Phishing Trends

Vishing (voice phishing) uses live calls, callbacks, and help-desk manipulation to bypass email filters. The Verizon 2026 DBIR tracks pretexting , synchronous voice or chat , at 6% of initial access (p. 10-12). Phone-centric phishing simulations median near ~2% click versus ~1.4% for email (~40% higher, p. 50).

Keepnet's Extended Human Risk Management Platform (xHRM) pairs multi-channel simulations with Secure Behavior Management (SBM) outcomes: reporting speed and repeat-failure cohorts, not completion exports alone.

Source: Gartner, "6 Ways to Transform Your Cybersecurity Awareness Program" (G00840741, March 2026), based on the 2025 Secure Behavior Strategies Survey (n=65).

Executive summary: vishing statistics 2026

• Pretexting (voice/chat): 6% of initial access (DBIR 2026)
• Phone sim median click: ~2% vs email ~1.4% (DBIR 2026, p. 50)
• Only 10% of leaders prioritize deepfake recognition vs 73% prioritizing phishing reporting (Gartner 2025, n=65)
• 35% of organizations affected by deepfake incidents (Gartner 2025, n=302)

Vishing statistics at a glance

Vishing statistics at a glance (2026)

Why this matters

Legacy vishing pages cite consumer scam-call surveys without breach context. DBIR separates pretexting from inbox phishing for a reason.

What security leaders should do

Use DBIR pretexting % in board decks, not undated robocall stats. baseline vishing simulations against the ~2% median.

Vishing vs email phishing statistics

Asynchronous phishing (email, SMS links) accounts for 16% of initial access; pretexting adds 6%. Combined identity manipulation (phishing + credentials + pretexting) totals 35% , comparable to vulnerability exploitation at 31% (DBIR 2026). Email-only security awareness grades the easier test.

Why this matters

Gartner reports 73% of leaders prioritize phishing reporting (n=65) while phone channels show higher sim failure rates.

What security leaders should do

Run voice and callback scenarios alongside email. See phishing statistics 2026 for the full multi-channel matrix.

Deepfake and AI voice phishing statistics

Gartner's 2025 AI Risk Management Survey (n=302) found 35% of organizations experienced a deepfake incident. Only 10% of security leaders prioritize deepfake recognition training (G00840741, n=65). The Arup deepfake CFO case (Hong Kong, 2024) cost approximately $25.6M USD (HK Police briefing).

Why this matters

Synthetic voice closes the loop after an email lure. Programs without executive verification workflows remain exposed.

What security leaders should do

Require second-channel approval for wires and credential resets triggered by voice or video.

Real-world vishing cases

MGM Resorts (September 2023): ~$100M impact estimate (SEC Form 8-K). Industry reporting describes vishing to IT help desk for MFA reset.

DBIR 2026 contributor data: Keepnet contributed anonymized voice and SMS simulation data (p. 118). Enterprise phone sim medians validate help-desk and callback playbooks.

What security leaders should measure

Vishing program metrics

eCrime breakout time trend (CrowdStrike 2026)

CrowdStrike average eCrime breakout time by year (Figure 3): 98 min (2021), 84 min (2022), 62 min (2023), 48 min (2024), 29 min (2025), roughly a 70% reduction from 2021 to 2025 (CrowdStrike 2026 Global Threat Report, p. 11).

Deepfake voice on live calls (Gartner G00847786)

Voice phishing now overlaps with real-time deepfake audio. Gartner's 2026 CISO role-based survey (n=297) found 41% of organizations experienced a deepfake combined with social engineering on an audio call, and 35% on a video call (Gartner G00847786). Pair those rates with DBIR phone-centric simulation medians (~2% click vs ~1.4% email) when you justify vishing program budget.

Contact center controls Gartner recommends

Beyond voice biometrics, G00847786 lists caller metadata checks, phone number intelligence, and SIM-swap detection. Programs that only simulate inbox links miss the channel where deepfake audio is scaling fastest.

Sources

• Verizon 2026 DBIR summary
• Gartner G00840741, G00840678 (2025 surveys; n labeled in body).
• CrowdStrike, 2026 Global Threat Report (Year of the Evasive Adversary), p. cited in body.
• Gartner G00847786: Cybersecurity Threat: Deepfake Identity Impersonation (Akif Khan, 28 May 2026).

Related reading

• Phishing statistics 2026
• What is vishing?
• Smishing statistics 2026
• Vishing Simulator

What teams should do next

Pair these statistics with operational controls: help-desk callback verification, executive corroboration rules, and voice phishing simulations baselined against DBIR medians. For the full cross-channel stat pack, read phishing statistics 2026.

Related reading

• KnowBe4 alternatives (2026)
• 2026 Verizon DBIR summary