Vishing definition: Vishing, or voice phishing, substitutes emails with phone calls, voice messages and deepfake audio clips to manipulate targets into granting unauthorised network access.
Voice-based social engineering: Vishing attacks rely heavily on social engineering techniques that exploit human emotion and trust, cognitive overload and lapses in concentration.
Prevalence of vishing attacks: Vishing attacks doubled in the first six months of 2026, compared to the second half of 2025, according to CrowdStrike’s 2026 Threat Hunting Report.
Voice phishing, or ‘vishing’, uses voice – phone calls, voice messages, deepfake audio clips – to manipulate victims into turning over network access credentials, classified data, or payment authorisation to the criminals.
Like its predecessor, this more sophisticated form of social engineering relies on exploiting emotion and trust. Attackers apply pressure under the pretext of ‘urgency’, relying on typical work behaviours such as multitasking, cognitive overload, tiredness and lapses in concentration, which affect the degree of susceptibility.
This audio file was produced by AI and has been adapted from the original article for audio purposes.
2026 has seen twice as many Vishing attacks in the first six months than the second half of 2025, according to CrowdStrike’s 2026 Threat Hunting Report . In 2025’s report, CrowdStrike noted a 442% rise in voice-based social engineering attacks over the course of 2024.
Last year, over Easter, three jewels in the UK retailing crown – Marks & Spencer, Co-op and Harrods – were all hit by vishing attacks in quick succession . M&S estimated the breach cost £300m, with the Co-op breach earmarked around £207m .
Those attacks compelled the National Cyber Security Centre (NCSC) to warn that criminals were impersonating IT help desks , phoning up and fooling staff into complying with access requests, or certain instructions.
“A common strategy is to call someone and claim to be the IT department, needing to access their device to resolve an issue,” says Mike Freeman, IT manager at Cambridge-based Costello Medical. “AI can now simulate different voices and personalities very convincingly and this is only becoming more convincing over time,” he warns.
Two forms of vishing currently dominate the landscape:
The ‘Adversary in the Middle’ (AiTM) tactic
In an AiTM attack the phone calls or voice clips direct the victim to a proxy server that mirrors the company’s own, and which captures their live multi-factor authentication details and other access privileges. Cyber criminals similarly impersonate senior executives or colleagues, to trick staff into making financial transactions, or stealing data.
“This is more likely if there are clips containing somebody’s voice online, which can be used to train an AI,” says Freeman.
The ‘TOAD email’ gambit
Vishing is increasingly carried out via Telephone-Oriented Attack Delivery (TOAD), where the attacker sends an innocent-looking email, invoice, or ‘urgent’ message, prompting the victim to call a number to ‘resolve the issue’ or face disaster. Crucially, the initial email will contain no links or characteristics likely to be picked up by phishing email filters and so flies under the cyber security radar. Once the victim responds to the ‘TOAD email’ and makes the call, the attackers begin convincing them to follow instructions or surrender control of their screen.
Increasingly, a combination of AiTM and TOAD is being used, where the impersonator calls in and convinces the victim to access a proxy server set up for the particular breach the attackers have planned.
How to defend against vishing
“Recognise if you are being asked to do something that’s high-risk,” is Freeman’s advice. “For example, [requests] to give information, money, passwords, access, or to click a link, run a code or perform any unfamiliar task on a computer.”
He adds: “Stop and validate if the risk is high. End the call and call back on a known number.
And check with other trusted contacts, for example, another member of your IT team, to see if the call was expected.”
As Freeman alludes, it is evident that, despite increasingly sophisticated cyber security technology, there is arguably a limit to its powers. Cyber crime attacks are mainly successful when they manage to exploite human fallibility and vulnerability, and that is where defences must be strengthened. Organisations would benefit from mapping and assessing their work practices to identify vulnerabilities and determine how best to address them.
Cyber: how to spot a vishing attack
Cyber: assessing your insurance for the AI age
Cyber: inside the evolving world of cyber crime
Common data protection fails and how to prevent them
Cyber: how prompt injection attacks target your AI tools
Is your identity at risk?
What does Modernising Corporate Reporting mean for auditors?
Healey's budget options narrowing
How did MTD go? The dangers of digital fraud
How to plan for a Russian test of NATO
Our cyber security resource centre provides a focal point for ICAEW members looking for support in managing cyber risks.
Browse ICAEW resources aimed at helping members to build their understanding of AI, including opportunities and challenges it presents.
Browse upcoming and on-demand ICAEW events and webinars focused on making the most of the latest technologies.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
