When IT Support Becomes the Attack: Understanding the Rise of Voice Phishing

Introduction

Voice phishing accounted for 11% of observed initial infection vectors in 2025, making it the second most common vector recorded in Mandiant’s latest M-Trends report.

The rise of vishing shows how attackers are changing the way they gain access to organisations. Instead of relying only on malicious emails or links, attackers can use a phone call to impersonate IT support, create a sense of urgency and persuade employees to reset credentials, approve MFA requests or grant access to their devices.

The risk goes beyond the employee who receives the call. When an attacker successfully impersonates someone trusted, they can use legitimate account recovery and access processes to move deeper into an organisation.

Understanding the Landscape

Vishing works because the attacker is trying to make a legitimate process look like a normal IT request. A caller may claim that an employee’s account has been locked, that their MFA is failing or that a security issue needs to be resolved immediately. The pressure is designed to make the employee act before verifying who is actually on the other end of the call.

The information needed to make the call convincing is often easy to find. Public employee information, job roles and company details can help an attacker sound familiar and credible. Once trust is established, the attacker may ask for a password, MFA code, approval of an unexpected authentication prompt or a change to account recovery settings.

CIL Perspective

The important question is not whether an employee can recognise every fake IT support call. Organisations also need to examine the processes that allow access to be recovered or changed.

A help-desk request involving a password reset, MFA reset or new-device enrolment can have security implications. If identity verification depends too heavily on the caller’s information or the urgency of the request, an attacker may be able to manipulate the process.

Organisations therefore need controls that make verification part of the process, even when the person making the request appears legitimate.

CIL Solution

CIL’s approach focuses on strengthening both the human and technical controls around identity and access.

1. Strengthen identity verification: Apply defined verification procedures before password resets, MFA changes and new-device enrolment.

2. Monitor authentication activity: Track unusual logins, MFA changes, password resets and other account activity that may indicate compromise.

3. Investigate unexpected changes: Review suspicious authentication and account-recovery events before they develop into wider access.

4. Improve employee awareness: Train employees to recognise social engineering tactics and verify unexpected requests through established channels.

5. Maintain oversight of Microsoft 365 and Google Workspace environments: Apply appropriate administrative controls and monitor account activity across the platforms employees use every day.

Conclusion

Organisations can reduce this risk by combining employee awareness with stronger verification procedures and continuous monitoring of identity and access activity. When the process is designed to verify first and act second, a convincing phone call becomes much harder to turn into unauthorised access.