Voice Phishing (Vishing): The Fake IT Support Call

Attackers increasingly exploit human trust through a social engineering technique called voice phishing (vishing). Rather than sending malicious emails or links, they impersonate IT support, help-desk staff, or trusted executives over the phone and manipulate victims into disclosing credentials or bypassing Multi-Factor Authentication (MFA). A recent incident involved healthcare company McKesson, in which hackers got into their third-party applications and stole data.

How it works

The Exploit Mechanism

Attackers research targets using public information, then impersonate IT support or a legitimate employee.

The Manipulation

They create urgency by claiming the user is locked out or has lost access to MFA, then pressure them to share a code, approve a prompt, or reset MFA.

The Threat

Successful vishing can lead to:

1. Unauthorised Access: Access to email, cloud apps, files, and SSO-connected services.
2.Account Takeover: Stolen credentials or compromised MFA enable impersonation and persistent access.
3. Further Compromise: Attackers can access other systems, steal data, or launch additional attacks.

Best Practices

1. User Awareness & Verification (Critical): Employees should never share passwords or MFA codes over the phone or approve unexpected authentication prompts. Any caller claiming to be IT support or another trusted individual should be independently verified through an established communication channel.

2. Strong Help-Desk Verification Procedures: Require an independent identity verification process before performing password resets, MFA resets, or new-device enrolment. Urgency should never override established security procedures.

3. MFA & Access Monitoring: Monitor for unusual authentication activity, MFA changes, password resets, and new-device enrolments. Investigate unexpected account recovery or authentication changes promptly.