Vishing under the microscope: how bad is it and what can you do about it?

The Hidden Danger of Vishing: Protecting Your Organization from Voice Phishing Attacks

Did you know that 68% of data breaches in 2023 involved human error? According to the Verizon Data Breach Investigations Report, most breaches stemmed from social engineering attacks, including phishing and its lesser-known counterpart, vishing. Vishing exploits voice communication to deceive employees into divulging sensitive information.

To uncover the scale of this threat, Keepnet Labs conducted a year-long vishing simulation across multiple industries. The findings, published in the Keepnet Vishing Report, highlight how alarmingly vulnerable employees can be to these voice-based scams.

In this blog, we’ll discuss why vishing is a significant threat, explore the findings from Keepnet’s vishing campaign, and outline practical strategies to fortify your defenses against this evolving cyber risk.

Why Vishing Matters

Humans are inherently social and responsive to authority, making them prime targets for manipulation. Unlike email phishing, vishing leverages real-time interactions, making fraudulent requests feel more urgent and credible. Scammers often impersonate trusted figures, such as bank managers or IT support, to coerce victims into:

• Revealing login credentials for corporate systems.
• Approving fraudulent financial transactions.
• Resetting passwords to grant attackers unauthorized access.

Advanced tools like spoofed Caller ID and deepfake audio amplify the realism of these scams. In one case, a UK-based company lost $25 million after an attacker mimicked the CFO’s voice using AI.

Findings from Keepnet’s Vishing Simulations

Between January 2023 and January 2024, Keepnet ran simulated vishing campaigns targeting employees in various sectors. Here’s what we discovered:

• 7% of employees who answered the calls fell for the scam. While this may seem small, even one successful attempt can cause severe damage.
• 40% didn’t answer the calls. It’s unclear if this was due to suspicion or other reasons, leaving their risk profile undetermined.
• 53% recognized the scam and refused to share information.

Industry Vulnerabilities

Certain sectors and roles proved more susceptible:

• Manufacturing & Engineering: 19% fell for vishing attempts.
• Entertainment & Media: 18% were deceived.
• Customer Support Staff: 12% failed the simulation.
• IT Workers: Surprisingly, 7% succumbed to vishing.

Strategies to Mitigate Vishing Risks

Given the evolving sophistication of vishing, organizations must adopt proactive measures to safeguard against such attacks.

1. Personalize Training for Vulnerable Roles

Tailor security training for high-risk departments like customer support and sales teams that frequently interact with external contacts. Use vishing simulation tools to mimic real-world scenarios.

2. Customize Training to Industry Threats

Industries face unique risks. For example, manufacturing firms may be targeted for intellectual property, while media companies could face reputation-damaging leaks. Sector-specific training ensures employees are equipped to counter targeted attacks.

3. Foster a Culture of Continuous Learning

Cyber threats evolve constantly. Organizations must:

• Regularly update training modules.
• Host interactive workshops to maintain engagement.
• Encourage peer learning through shared experiences.

4. Reward Vigilance

Recognize and reward employees who successfully identify and report vishing attempts. This fosters a positive security culture and motivates vigilance.

5. Streamline Reporting Mechanisms

Simplify the process for reporting suspicious calls. Employees should feel confident flagging potential threats without fear of judgement.

The Role of Technology in Vishing Prevention

The right tools can make all the difference. Look for solutions that offer:

• Customizable vishing simulations for different roles and industries.
• Detailed analytics and reporting to identify high-risk groups.
• Automated updates to stay ahead of emerging threats.

Managed vishing awareness services can offload the burden from IT teams, ensuring consistent and effective training. Keepnet Labs found that organizations implementing regular simulations achieved up to a 90% success rate in identifying and mitigating vishing attempts.

Conclusion

As voice phishing becomes an increasingly common attack vector, organizations must prioritize vishing awareness training and proactive defense measures. By combining customized training, a culture of vigilance, and advanced tools, you can minimize the risk of vishing-induced breaches.

For more insights, download Keepnet’s 2024 Voice Phishing Response Report and start safeguarding your team today.

Editor's Note: This blog was updated on December 9, 2024.