Skip to content

Scam Types

What is vishing? How to spot phone call scams in 2026

Vishing is phishing by phone call — scammers call you pretending to be from a bank, government agency, or known company to trick you into sharing personal information, transferring money, or installing software. As of 2026, AI voice cloning has made vishing harder to detect than ever. If a call you didn’t expect is asking you to act fast, hang up and call the organization back on a verified number.

Last reviewed: May 10, 2026  ·  Drafted with AI assistance. Reviewed and edited by a human editor before publication.

01

What is vishing? (Definition)

Vishing, short for “voice phishing,” is a deceptive practice where criminals use the phone to steal information or money. Unlike email or text scams, vishing allows scammers to use tone of voice, background noise, and high-pressure scripts to manipulate victims in real-time.

In early 2026, call-analytics data from YouMail’s Robocall Index estimated that unwanted telemarketing and scam calls in the US reached 29.6 billion in 2025 — a 15.4% increase on the prior year. Modern vishing often involves “spoofing,” where the scammer manipulates your caller ID to make it look like they are calling from a local number, your bank, or even a police station. While vishing has been a threat for decades, the integration of artificial intelligence in 2025 and 2026 has fundamentally changed the risk level for consumers.

02

Why is vishing different from other phishing in 2026?

As of 2026, vishing has become the “front line” of AI-enabled fraud. Traditional vishing relied on human callers following a script; however, AI voice cloning now allows scammers to impersonate specific individuals with terrifying accuracy.

McAfee’s 2025 AI voice-cloning study found that only three seconds of audio is enough to create a voice clone with an 85% match. By scraping short clips from social media or public videos, scammers can call family members pretending to be a relative in distress. This eliminates the traditional “I’d recognize my mom’s voice” defense. Additionally, Sumsub research recorded a 700% jump in deepfake-related fraud between early 2024 and early 2025.

Warning

Voice cloning now requires only a few seconds of audio. If a family member or friend calls in distress asking for money or sensitive information, hang up and call them back on their known number. Even if it sounds exactly like them.

03

How do you spot a vishing call? (Warning signs)

As of 2026, scammers update their tactics to be more convincing, but vishing calls almost always rely on a few specific triggers. Because recognition must happen instantly during a live call, look for these seven signs:

  1. Caller ID spoofing — The call appears to be from a trusted organization (like your bank or the IRS) or a local number, but it is actually coming from an international scam center.
  2. Urgency and pressure — You are told that you must act “immediately” to stop an arrest, a massive bank charge, or a computer virus.
  3. Request for payment via “alt” methods — The caller insists you pay using gift cards, wire transfers, or cryptocurrency. Legitimate organizations do not accept these for payment.
  4. Threats of immediate consequences — Scammers claim the police are on their way, or that your bank accounts will be permanently frozen if you hang up.
  5. Requests to “verify” sensitive info — They ask you to “confirm” your full Social Security number, bank PIN, or credit card details to “prove” who you are.
  6. Claims of “police” or “IRS” involvement — Unsolicited calls about unpaid taxes or warrants. The IRS and HMRC do not initiate contact via phone call to demand payment.
  7. Pressure not to hang up — The caller will try to keep you on the phone, often by claiming the “security window” will close if you disconnect.

Key Takeaway

The single most reliable defense against vishing is simple: hang up and call back. No legitimate organization will refuse to let you do this. If a caller insists you must stay on the line or use a number they give you, that’s the call ending.

04

What does vishing actually look like? (Real examples)

Example

These examples are paraphrased from real vishing calls reported in 2025 and 2026. Scammers iterate on these scripts daily.

Scenario 1: The fake bank fraud department

The call: “This is [Bank Name] fraud department. We’ve detected three suspicious charges on your card. To secure your account, we need to verify your PIN and the code we just texted you.”

What makes it vishing: A real bank will never ask for your PIN or a one-time code over the phone. The scammer is trying to bypass your 2FA to empty your account.

Scenario 2: The “Microsoft” tech support scam

The call: “We’ve received a security alert from your Windows computer. Your data is being uploaded to a server in another country. You need to install a remote support tool so we can block the attack.”

What makes it vishing: This aims to get remote access to your computer. Once inside, they can steal saved passwords or install ransomware.

Scenario 3: The AI family emergency

The call: “Mom, it’s me. I’ve been in an accident and my phone is broken. I’m at the hospital and they won’t treat me unless I pay the deductible now. Please help.”

What makes it vishing: Scammers use AI voice cloning to mimic a child’s voice. As of late 2025, one in four people had encountered or known someone hit by an AI voice scam.

05

What should you do if you receive a suspicious call?

  1. Hang up. If you feel pressured or suspicious, end the call immediately.
  2. Do not engage. Do not press buttons (like “Press 1 to speak to an agent”) as this confirms your number is active.
  3. Call back on a verified number. Use the official number found on the back of your bank card or the organization’s verified website.
  4. Use a “family safe-word.” If a “relative” calls in distress, ask for the family safe-word to verify it is really them.
06

What if you already shared information or sent money?

If you have shared your PIN, given remote access to your computer, or sent money via wire or crypto, you are in an active crisis. You must contact your bank immediately to freeze your accounts. Please visit our recovery guide for sharing information with a scammer for the specific steps to take to secure your identity and attempt to stop the payment.

07

How can you protect yourself from vishing in the future?

  • Establish a family safe-word. The FBI explicitly recommends that families set a secret code word to verify identity during emergency or AI-voice calls.
  • Register for “Do Not Call” lists. While this doesn’t stop illegal scammers, it reduces the volume of legitimate marketing calls, making it easier to spot the “outliers.”
  • Use carrier spam blocking. Most mobile networks in 2026 provide “Scam Block” or “Spam ID” services that label suspicious calls before you pick up.
  • Trust the “hang up” rule. No real government agency or bank will be offended if you hang up to call them back on their official, published number.
08

Sources

  • YouMail Robocall Index — 2025 Annual Report — cloudcommunications.com. Accessed May 2026. Cited for US unwanted call volume data.
  • McAfee AI Voice Cloning Research — mcafee.com. Accessed May 2026. Cited for 3-second cloning and match accuracy statistics.
  • Sumsub Deepfake Fraud Analysis 2025 — truescreen.io. Accessed May 2026. Cited for 700% jump in deepfake fraud.
  • FBI Virtual Kidnapping & Safe-Word PSA — ic3.gov. Accessed May 2026. Cited for family safe-word and AI extortion guidance.
  • FTC Government Impersonation Guidance — consumer.ftc.gov. Accessed May 2026. Cited for “hang up and call back” rule.