What is vishing? Phone scams that sound official, and the moment to hang up

Phishing, by voice

CISA, the US cybersecurity agency, defines vishing as the social engineering approach that uses voice communication. It is phishing, but on a call instead of in an email. The two often work together: a text or an email gives you a number to call, and the real work happens once you are talking to someone.

It is the sibling of smishing, which is phishing by text message, and of the phishing emails you have probably seen already.

What makes a call more dangerous than an email is time. On a call you can't hover over a link or wait until tomorrow. Someone is talking, they sound official, and they want an answer now.

Why caller ID proves nothing

The first thing to know: scammers can make any name or number show up on your caller ID. It's called spoofing. A call that says "Social Security Administration" or shows a local number could be coming from anywhere in the world, the FTC warns.

CISA adds why: internet calling makes it easy to fake caller ID, and it takes advantage of the trust people place in phone calls, especially landlines.

So the name on the screen tells you nothing. What the caller asks you to do tells you everything.

A real script, from October 2026

On October 22, 2026, the FTC described the latest version of a call that impersonates the FTC itself. It is a good example of how long and convincing these scripts have become:

1. Someone says they are an FTC official and reads out a badge number (the badge is fake). They say a phone registered under your name and number is being used to commit scams in another country, and that your number will be deactivated if you don't cooperate.
2. They transfer you to a "police officer" to file a report. If you hesitate, they tell you to call the police department back yourself, and tell you what to search online to find the number. It feels like you are checking their story. The number you find leads back to people in the scam.
3. They ask for your ID and personal information for the "report," and tell you to keep everything secret.
4. Later the news gets worse: you are under arrest, and you must travel to another country, unless you send money for a "security deposit."

The FTC's answer: none of it is true. A real FTC employee will never ask you to send money, connect you to someone who does, threaten to disconnect your phone, tell you to keep your conversations secret, or text you a photo of their ID to prove who they are.

Notice step 2. Verifying a story using a number or a search term the caller gave you is not verifying it. Use a number you found yourself, before the call.

The calls you are most likely to get

The FTC lists the angles phone scammers use most. Any of them can come as a vishing call:

• Government and law enforcement. The IRS, Social Security, the FBI, the sheriff's office or a court. You owe money, or you will be arrested, fined or deported. Real law enforcement and federal agencies won't call and threaten you.
• Your bank, or "fraud prevention." There's a problem with your account, or someone is using your identity, and they are here to help.
• Tech support. A company you know says something is wrong with your computer and asks for remote access.
• Family or a love interest. Someone close to you in an emergency. The FTC warns that with voice cloning, the caller can sound just like a person you know.
• Prizes, loans and debt relief. You won something, or qualify for a loan or lower interest, but you have to pay a fee first.

The questions no one legitimate asks

Most vishing calls end with one of a few requests. Learn these and the story stops mattering.

"Read me the code we just sent you." A verification code is the second lock on your account, after your password. The FTC's rule is absolute: anyone who asks you for your verification code is a scammer. If you give it, they can sign in and move your money.

"Pay with a gift card, a wire, crypto or a payment app." The FTC says anyone who insists you can only pay that way is a scammer. Those methods are chosen because the money is hard to get back. See our gift card scam guide.

"Move your money to keep it safe." The FTC will never tell you to transfer your money to "protect it," withdraw cash, or buy gold and hand it to someone.

"Confirm your Social Security number." No government agency calls out of the blue to ask for sensitive information like that.

"You have to decide now." Most honest businesses give you time and written information before you commit.

"Don't tell anyone." Secrecy is how the scam protects itself from the people who would stop it.

What to do during the call

• Hang up. You don't owe anyone a polite ending.
• Call back on a number you trust, like the one on your bank statement, the back of your card, or in your app. The FTC says never to use the number the caller gave you; it will take you to the scammer.
• Don't press a number to "speak to an operator" or "be removed from the list" on a robocall. The FTC says that can lead to more calls.
• If they sent you a link by text or email during the call, don't open it on the spot. Paste it into our checker first. We open it in a browser that is not yours and tell you where it really goes, how new the site is, and whether it asks for a login or a payment.

If you want to know whether a number has been reported, you can look it up. But remember the spoofing problem: a call can show a number that belongs to someone else entirely.

If you already paid or shared something

Act quickly. The FTC's steps depend on how you paid:

• Credit or debit card: contact the card issuer, say it was a fraudulent charge, and ask them to reverse it.
• A transfer you didn't authorize from your bank account: contact your bank and ask them to reverse it.
• Gift card: contact the company that issued it, and keep the card and receipt.
• Wire transfer: call the company. The FTC lists MoneyGram at 1-800-926-9400 and Western Union at 1-800-448-1492. If you wired through your bank, call your bank.
• Payment app: report it to the app and ask them to reverse it; if the app is linked to a card, tell the card issuer too.
• Cryptocurrency: contact the company you used to send it and ask them to reverse the transaction.
• Cash sent by US mail: call the US Postal Inspection Service at 877-876-2455 and ask them to intercept the package.

If you gave your Social Security number, go to IdentityTheft.gov. If you gave a password, create a new, strong one, and change it anywhere else you used it.

Then report the call to the FTC at ReportFraud.ftc.gov. Include the number that called you, the number on your caller ID, any number they told you to call back, and the date and time. The FTC releases reported numbers to the public each business day, which helps phone carriers and others build call blocking.

One more warning from the FTC: if someone calls offering to help you recover money you already lost, don't give them money or personal information. That is usually the next scam.

Sources: CISA: Avoiding Social Engineering and Phishing Attacks (archived, Feb 2021) · FTC: Phone Scams · FTC: The FTC is not calling to deactivate your phone number (Oct 22, 2026) · FTC: What's a verification code and why would someone ask me for it? · FTC: Avoiding and Reporting Gift Card Scams