Most employees have learned to be cautious with suspicious emails. Attackers have noticed. Today, social engineering increasingly happens through phone calls, text messages, collaboration apps, and even AI-generated voices and video.
These attacks are effective because they feel personal and urgent. Understanding how they work is the first step toward protecting your business.
What Is Vishing?
Vishing, or voice phishing, uses phone calls to trick people into sharing information or taking action. A caller may pretend to be from the IT help desk, a bank, a vendor, or a senior executive.
Common vishing scenarios include:
- A “help desk technician” asking an employee to approve a login prompt or share a verification code
- A “vendor” calling to update payment information
- A caller claiming to be from a government agency and demanding immediate payment
- An attacker calling the help desk while pretending to be an employee who needs a password reset
Caller ID can be spoofed, so a familiar number does not guarantee a legitimate call.
What Is Smishing?
Smishing uses text messages to deliver phishing links or requests. Because people often read texts quickly on their phones, smishing can be especially effective.
Examples include:
- Fake package delivery notifications
- Messages that appear to come from the CEO asking for a quick favor, such as buying gift cards
- Alerts claiming an account has been locked
- Links to fake login pages for business applications
The Rise of Deepfakes
Artificial intelligence has made it possible to create convincing fake audio and video. With only a short sample of someone’s voice, attackers can generate realistic speech. Public videos, podcasts, and social media posts provide plenty of material.
Deepfakes may be used to:
- Impersonate an executive on a phone call to request an urgent wire transfer
- Leave a voicemail that sounds like a trusted colleague
- Join a video meeting while posing as a known contact
These attacks exploit trust. When a request sounds exactly like the boss, employees may act before questioning it.
Collaboration Apps Are a Target Too
Attackers also use platforms such as Microsoft Teams and other messaging tools to contact employees directly, often posing as IT support. Because these platforms feel internal, employees may be less suspicious.
Warning Signs of Social Engineering
Regardless of the channel, social engineering attacks often share common traits:
- Urgency: Pressure to act immediately
- Authority: Claims to be an executive, official, or technician
- Secrecy: Requests to keep the conversation confidential
- Unusual requests: Payments, gift cards, codes, or credentials
- Changed details: New bank accounts or contact information
How to Protect Your Business
Establish Verification Procedures
Require verification for sensitive requests, especially payments, banking changes, and credential resets. Employees should confirm requests using a known phone number or a separate communication channel, never the contact information provided in the suspicious message.
Never Share Verification Codes
Employees should know that legitimate IT staff will never ask them to read back a multi-factor authentication code or approve a login they did not initiate.
Strengthen Help Desk Procedures
Help desk teams should verify identity carefully before resetting passwords or changing authentication methods.
Train Employees on Every Channel
Security awareness training should cover phone calls, text messages, and collaboration apps, not just email.
Consider Code Words for High-Risk Requests
Some organizations use internal verification phrases for sensitive financial requests, adding another layer of protection against deepfakes.
Encourage a Pause
Remind employees that it is always acceptable to slow down and verify. A legitimate request can wait a few minutes. A fraudulent one depends on speed.
Prepare Your Team for Modern Social Engineering
Attackers will continue using whatever channels work. Businesses that train employees and build strong verification habits are far better prepared.
InfoSystems helps organizations strengthen security awareness and protect against evolving social engineering threats. Contact us to learn more.
