Vishing is a method of deceiving the victim using voice. For this reason, the letter “p” in the word phishing is replaced with the first letter of the word voice, giving it the meaning of “voice deception.”
In social engineering cases, vishing is reinforced by the opportunities technology provides, aiming to obtain information more easily from the person being called.
With the vishing fraud method, emails are sent aiming to obtain customers’ account numbers, credit card information, and other personal data, directing victims to various phone numbers given in the content of these emails. When the victim calls these fake phone numbers, a system that the fraudster has prepared in advance to mimic a bank’s voice response system and call center answers, and through this method fraudsters are able to seize the victim’s personal information.
Vishing attacks can be carried out not only through email, but also through a message sent to mobile phones. A site offering activities such as “send a free SMS” or “sign up to win X TL in points” may collect your mobile phone number along with your user information during registration, and later send bulk SMS messages through a rented line. The content of the message reaching mobile phones will be similar to the content of the emails, and fraudsters may again aim to seize your information through similar scenarios.
Scenario: Mustafa Bey, the manager of a corporate company, receives an email on a very busy day from Bank X, the bank he regularly works with and trusts. The email he receives informs him that his accounts will become inactive within 2 days and that he urgently needs to call the call center to reactivate his accounts.
Trusting this email, which appears to be entirely from Bank X, Mustafa Bey calls the specified call center. Not suspecting the fake call center voice response system at all, Mustafa Bey enters his credit card information into the system to reactivate his accounts and completes the process. Relieved that his accounts have been reactivated, he goes out for lunch. However, he will soon learn that his card information has been stolen, and by then it will be too late.
So what should we do to avoid falling into this kind of situation?
- Do not answer calls from numbers you don’t recognize. Calls from consecutive private numbers in particular are used to create the image of a corporate company. Pay close attention to this kind of number.
- No prosecutor or police officer calls someone and asks them to come to a location over the phone. They may ask you to come to the police headquarters; in that case, you can go to the police headquarters yourself and look into all the details.
- Research the current scams carried out by fraudsters at regular intervals, and stay informed about these kinds of methods.
- Do not call phone numbers that reach you through various channels such as email or SMS.
- For sensitive matters such as banking, have authorized personnel verify the accuracy of the number you are calling.
- When contacting places such as your bank, use the phone number printed on the back of your card.
- Do not conduct conversations that require entering sensitive information in public or in a loud voice.
- If you suspect that this method is being used against you, report the situation to the authorities.
