Vishing, or voice phishing, is phishing conducted over the phone. Attackers use deceptive calls to impersonate trusted entities and obtain sensitive information or induce actions. section 11.2.2
Fabricated IT password-reset call
An attacker claims to be from the IT department, cites company policy, and asks an employee to visit a URL, log in, and change a password. Authority and urgency increase the likelihood of compliance. section 11.2.2
Reduce exposure by:
- Training users to recognize deceptive requests and respond appropriately. section 11.6
- Raising awareness of potential social-engineering threats. section 11.6
