Vishing & Smishing

Phishing, vishing, and smishing are three forms of social engineering attack that differ by delivery channel. Phishing is conducted via email. Vishing (Voice Phishing) is conducted via telephone call. Smishing (SMS Phishing) is conducted via text message. All three aim to deceive the target into disclosing credentials, approving transactions, or taking actions that benefit the attacker. Vishing tends to have the highest success rate because real-time voice interaction creates psychological pressure that email and SMS cannot replicate. Testing all three vectors in a controlled simulation provides complete coverage of the social engineering attack surface.

Vishing (Voice Phishing) is a social engineering attack in which an attacker calls a target by phone, impersonating a trusted authority such as an IT helpdesk operator, bank representative, or senior executive. The goal is to manipulate the victim into disclosing sensitive information (passwords, MFA codes, account numbers), approving a fraudulent transaction, or performing an action that creates a security exposure. Vishing is significantly more effective than email phishing because voice interaction creates real-time psychological pressure that written communication cannot replicate.

Smishing (SMS Phishing) is a social engineering attack delivered via SMS or text message. Attackers send messages impersonating trusted organisations (commonly HMRC, Royal Mail, NHS, or a corporate IT department) to trick recipients into clicking malicious links, disclosing MFA codes, or entering credentials into fake websites. Smishing is effective because SMS messages are trusted more than email, are typically read within minutes of receipt, and are often accessed on personal devices outside corporate security controls.

Vishing is consistently the highest-converting social engineering vector in controlled simulation environments. Industry data indicates that voice-based attacks succeed 3 to 5 times more often than equivalent email phishing attempts. The primary reason is psychological: it is significantly harder to refuse or question a human voice in real time than to ignore or report a suspicious email. In red team engagements, vishing is frequently the technique used to gain an initial foothold when the technical perimeter is hardened. Staff will disclose credentials over the phone that they would not enter into an unfamiliar web page.

We ensure strict compliance with RIPA and GDPR in all UK engagements. In a corporate simulation context, employees typically have signed Acceptable Use Policies that cover monitoring activities. We define specific recording protocols during the scoping call and will not proceed without explicit written authorisation from your legal or compliance team. This is addressed before day one of the campaign.

Yes. For high-security engagements, we simulate AI voice cloning using synthesised audio derived from publicly available executive content. This is particularly relevant for C-suite impersonation scenarios and finance team wire transfer requests, where the victim's instinct to trust the caller's voice is the primary vulnerability being tested. The simulation specifically probes whether your out-of-band confirmation procedures would detect a spoofed executive call. We recommend this scenario for organisations with a recent near-miss or whose executives have significant public-facing audio content.