Vishing Statistics 2026: Latest Trends & Voice Phishing Data

• Rising Calls and Losses: Vishing (voice phishing) is exploding worldwide. CrowdStrike measured a 442% jump in vishing between H1 and H2 2024, and its 2026 Threat Hunting Report says vishing intrusions doubled again in H1 2026 versus H2 2025. FBI IC3 tech support scam complaints rose from 37,560 in 2023 ($924.5M in losses) to 47,794 in 2025 ($2.13B).
• AI & Deepfakes Fuel Growth: Scammers now use AI voice cloning. A global survey cited by Group IB found over 10% of financial institutions had individual deepfake cases costing more than $1M, with an average loss of $600K per incident. Deloitte projects U.S. generative-AI-enabled fraud could hit $40B by 2027.
• Targets and Demographics: Financial execs, help desks, and support staff are prime targets. U.S. seniors 60+ suffer most tech support scam losses, but younger adults are also vulnerable: Truecaller found adults 18-44 were three times more likely than those 45+ to lose money to a phone scam in 2023. Phones, smartphones especially, remain a preferred scam channel.
• Global Hotspots: Brazil, South Korea, and Japan are hammered by phone scams. GASA estimated Brazilians lost about $54B to scams over 12 months in its 2024 report, Korea's voice phishing losses reached a record ₩1.2578 trillion in 2025 according to national police figures, and Japan's special fraud losses nearly doubled to ¥142.3B in 2025.
• Defenses and Training: Awareness pays off. KnowBe4's 2026 benchmark found phish-prone rates in email simulations fell from 33.2% to 4.2% after 12 months of training. For U.S. organizations testing vishing and social-engineering defenses, vishing simulations and incident plans help close gaps before attackers exploit phone-based trust workflows. With scams evolving, constant vigilance and penetration testing services that include voice phishing drills are essential.

Vishing (voice phishing, or phone-based social engineering) is no longer rare. These stats and trends highlight why leaders must track vishing data and strengthen defenses now. Alongside the latest vishing statistics, this guide explains what a vishing attack is, how it works, four documented examples, and how to defend the workflows attackers target.

What Is a Vishing Attack? Voice Phishing Explained

A vishing attack is a social engineering attack carried out by phone call, voicemail, or voice message. The attacker impersonates someone the target trusts, such as a bank, the IT help desk, a government agency, or an executive, to get credentials, MFA codes, a payment, or account access. Vishing is short for voice phishing. When the same kind of impersonation arrives by email and targets a specific person, it is spear phishing.

Vishing sits alongside phishing, smishing, pretexting and baiting among the main types of social engineering.

Vishing is phishing via phone or voice call, where attackers impersonate trusted figures (e.g., tech support, banks, government) to extract money or data. It exploits the trust we put in hearing a live human voice.

Unlike email phishing, vishing creates urgency through conversation e.g. Your account is at risk, press 1 to verify. Common scenarios include tech support scams claiming your device is infected or fake bank alerts. Attackers often spoof caller ID or use caller ID farming to appear legitimate. Some of these calls start with an email: fake McAfee renewal scams send a bogus invoice with a number to call to cancel the charge.

Vishing has become more sophisticated: AI voice cloning lets scammers mimic real people's voices from just a few seconds of audio. The result: highly convincing calls that even tech savvy users might trust. CrowdStrike found voice phishing skyrocketed by 442% between the first and second half of 2024, and vishing intrusions doubled again in the first half of 2026, as attackers leverage AI and multi channel tactics.

Understanding vishing trends is critical. These statistics show who is targeted, how much money is lost, and why we need new defenses like vishing simulation training and call authentication.

How a vishing attack works

Most vishing attacks follow the same four stages, whether the target is a retiree or a corporate help desk:

1. Reconnaissance: The attacker collects names, job titles, phone numbers, and internal jargon from social media, breached data, and earlier calls. The CISA and FBI advisory on Scattered Spider describes the group calling a help desk first just to learn how password resets work, then gathering the details needed to impersonate a specific employee.
2. Pretext: The caller adopts a believable role, such as IT support fixing a VPN problem, the bank's fraud team, a government agency, or an executive who needs an urgent transfer. Authority and time pressure do most of the work. In 2026 the same IT-support pretext led to a wave of law firm data breaches.
3. Spoofed or cloned call: The number on the screen and the voice on the line are made to look and sound legitimate, using caller ID spoofing, AI voice cloning, or both.
4. The ask: The call ends with a request. The target types credentials into a lookalike login page while the caller waits, reads out a one-time code, approves an MFA push, resets a password, authorizes an app, or sends money.

Caller ID spoofing means deliberately falsifying the number a recipient sees, so a call appears to come from a bank, an agency, or a company's own switchboard. In the U.S., the FCC required voice providers to implement STIR/SHAKEN caller ID authentication in the IP portions of their networks by June 30, 2021. Because the mandate applies to IP networks, not every call path is authenticated, and an authenticated number still doesn't prove who is speaking. Treat caller ID as a claim, not as proof.

AI voice cloning removes the check most people rely on: recognizing the speaker. The FBI warned in May 2025 that, since April 2025, criminals had been sending AI-generated voice messages that claimed to come from senior U.S. officials, and that AI voices "can sound nearly identical" to real ones. Its advice is to verify through a number you find independently and to agree on a secret word or phrase with family members. For the scale of the problem, see our deepfake statistics.

Real vishing attack examples

These four cases are documented by a regulator, a federal agency, or the threat intelligence team that investigated them. Each one turns on a different ask.

• Twitter, July 2020 (fake IT help desk): On July 14 and 15, 2020, attackers called Twitter employees claiming to be from the IT help desk and responding to a VPN problem. They steered staff to a lookalike VPN login page, entered the stolen credentials on the real site at the same time, and some employees approved the MFA prompts that followed. The New York State Department of Financial Services' Twitter Investigation Report (October 2020) found that 130 accounts were compromised, 45 of them were used to send tweets, and about $118,000 in bitcoin was stolen in roughly 24 hours. DFS concluded that hardware security keys would have stopped the attack.
• Cisco, May 2022 (voice phishing plus MFA fatigue): The attacker already had an employee's password, synced from a personal Google account. According to Cisco Talos (August 10, 2022), the attacker then called the employee over several days, posing as trusted support organizations, while sending repeated push requests until one was accepted. That single approval gave VPN access. Cisco detected the intrusion on May 24, 2022, and Talos reported that the only confirmed data taken was non-sensitive Box content and employee authentication data from Active Directory. Our guide to MFA fatigue attacks explains the push-bombing half of this attack.
• Salesforce data theft by UNC6040, 2025 (fake IT support and a rogue app): Google Threat Intelligence Group reported on June 5, 2025 that callers posing as IT support walked employees through Salesforce's connected app setup page and had them enter a "connection code." That linked an attacker-controlled, modified Data Loader app, in one case named "My Ticket Portal," which was then used to export data, with extortion demands following months later. Google stresses that no Salesforce vulnerability was exploited. For the later leak site, see our report on the Salesforce breach leak site.
• AI voice impersonation of senior U.S. officials, 2025 (cloned voices): In public service announcement I-051525-PSA (May 15, 2025), the FBI reported an ongoing campaign of texts and AI-generated voice messages claiming to come from senior U.S. officials. The targets were current and former officials and their contacts. After building rapport, the senders shared malicious links under the pretext of moving the conversation to another messaging platform, then used compromised accounts to target more contacts.

In all four cases the voice call was only the delivery mechanism. The damage came from a workflow that let one conversation reset access, approve a login, authorize an app, or open a channel. That is where defenses have the most leverage.

DeepStrike's social engineering and red team assessments can include pretext calls to teams such as the help desk, to test where caller verification breaks down.

Our guide to social engineering penetration testing explains how to scope vishing and help desk tests, including recording consent and pretext limits.

Why Vishing Statistics Matter in 2026

As of 2026, voice phishing is a top tier threat for organizations. Recent data reveal:

• Rapid Growth: OpSec data in the APWG Q4 2023 report show vishing incidents jumped 16% from Q3 to Q4 2023 and were nearly 260% higher than Q4 2022. CrowdStrike then observed a 442% surge in vishing from H1 to H2 2024, and its 2026 Threat Hunting Report says vishing intrusions doubled again in H1 2026 compared with H2 2025, highlighting a steep upward trend.
• Big Financial Impact: Annual losses hit the billions. Truecaller and The Harris Poll estimated Americans lost $29.8 billion to phone scams in 2021, and Truecaller's 2024 edition estimated 56.2 million U.S. adults lost $25.4 billion in 2023. FBI IC3 reports show tech support scams alone caused over $0.9 billion losses in 2023, and in 2025 call center fraud (tech support plus government impersonation) topped 80,000 complaints and $2.9 billion in losses, per the 2025 IC3 report. Deloitte projects U.S. generative-AI-enabled fraud losses could reach $40 billion by 2027, up from $12.3 billion in 2023.
• New Attack Techniques: The rise of AI means vishers can now clone voices from short audio samples. Hybrid attacks, e.g. email phishing followed by a trust building call, are growing: Fortra told APWG that hybrid vishing made up 6.1% of the attacks it recorded in Q4 2023, after rarely appearing before 2023. TOAD equals Telephone Oriented Attack Delivery; attackers combine text and voice.
• Who's at Risk: IC3 data show U.S. adults 60+ made up 40% of 2023 call-center fraud complainants (tech support and government impersonation) and accounted for 58% of those losses. In 2025, IC3 logged 201,266 complaints and $7.7 billion in losses from people 60+ across all crime types. But Truecaller's 2024 survey found adults 18-44 were three times more likely than those 45+ to lose money to a phone scam. Banks, finance teams, help desks, and customer support departments are frequent targets.
• Regulatory & Global View: Countries are responding. South Korea's police reported voice phishing losses of ₩447.2B in 2023 and ₩854.5B in 2024, prompting a national crackdown and discussions on bank liability. In the UK, Ofcom has required phone providers since May 2023 to identify and block, where technically feasible, calls with invalid or non-dialable caller ID numbers. Phone scams are also widespread in markets such as Brazil, where phone calls were the most common scam channel in GASA's 2025 survey.

These stats are a wake up call. Vishing isn’t just a nuisance; it’s a vector causing massive breaches and financial loss. Tracking up to date vishing statistics and trends helps security teams tailor defenses and measure training effectiveness e.g. using tools like the NIST Phish Scale to rate attack difficulty.

Key Vishing Trends and Data

Several authoritative reports and studies shine light on the vishing landscape:

• FBI IC3 Reports USA: The FBI's IC3 categorizes many phone scams under Tech/Customer Support and Government Impersonation. Tech support complaints went from 37,560 ($924.5M in losses) in 2023 to 36,002 ($1.46B) in 2024 and 47,794 ($2.13B) in 2025, while government impersonation added 32,424 complaints and $798M in 2025. The 2025 IC3 report also counts 22,364 AI-related complaints ($893M) and warns that voice cloning is used in wire fraud and grandparent scams.
• APWG/OpSec: The Anti Phishing Working Group's Q4 2023 report cites OpSec data showing voice phishing incidents increased 16% QoQ Q3 - Q4 2023 and nearly 260% YoY compared to Q4 2022. Fortra, also in the report, saw hybrid email+voice TOAD attacks rise to 6.1% of the attacks it recorded in Q4 2023.
• CrowdStrike Threat Reports: CrowdStrike's 2025 Global Threat Report, republished by the Virginia Fusion Center, found vishing spiked 442% from H1 to H2 2024, driven by callback phishing and help desk social engineering. Its 2026 Threat Hunting Report says vishing intrusions doubled again in H1 2026 versus H2 2025, with eCrime groups using vishing to compromise single sign-on accounts and steal SaaS data. This shift shows attackers leaning heavily into voice channels when social engineering emails get filtered.
• Mandiant M-Trends: Mandiant's M-Trends 2026 found that voice phishing was the initial infection vector in 11% of 2025 intrusions, second only to exploits (32%), while email phishing fell to 6%.
• Group IB: Security firm Group IB cites a global survey in which financial institutions reported an average loss of $600K per deepfake-related fraud incident, and over 10% said individual cases exceeded $1 million. Group IB also reports AI-related fraud attempts in Asia Pacific rose 194% in 2024 versus 2023. Separately, Deloitte forecasts U.S. generative-AI-enabled fraud losses reaching $40B by 2027.
• Truecaller/Industry Surveys: Industry surveys fill gaps in public data. Truecaller and The Harris Poll estimated 59.4 million Americans lost a total of $29.8B to phone scams in 2021, about $502 per victim; the 2024 edition estimated 56.2 million adults lost $25.4B in 2023, about $452 each. In Brazil, GASA's 2024 State of Scams report estimated $54B in scam losses over 12 months, with 94% of Brazilians reporting scam attempts at least monthly. GASA's 2025 Brazil report (1,000 adults, released November 2025, with a different method) put losses at R$99B and found phone calls were the most frequent scam channel, reported by 65% of respondents.
• Demographics and Targets: Older Americans are prime victims: in IC3's 2023 report, people 60+ made up 40% of call-center fraud complainants (tech support plus government impersonation) and suffered 58% of those losses (almost $770M). But businesses also face targeted attacks: Group IB warns that CEOs and finance execs are often impersonated with cloned voices to trick treasury teams into large transfers. Help desk and customer support staff also rank high because they can reset credentials and approve account changes.
• Pandemic Effect: COVID-19 gave scammers new pretexts, and remote work made calls impersonating IT support and help desks easier to pass off as routine.
• Global Hotspots: Phone-heavy markets are hit hard. In Brazil, GASA found 94% of people encounter scam attempts at least monthly. South Korea's national police data show voice phishing losses of ₩447.2B in 2023 and ₩854.5B in 2024, and losses passed ₩1 trillion ($718M) in just the first 10 months of 2025; police figures later put full-year 2025 losses at a record ₩1.2578 trillion. After a government task force formed in August 2025, voice phishing cases from October 2025 to July 2026 fell 39.9% year on year. Japan's special fraud losses, driven by phone scams such as fake police calls, nearly doubled to ¥142.3B in 2025.

Vishing vs Other Channels Email Phishing, Smishing

AI, Deepfake, and Hybrid Vishing

A key 2026 trend is AI powered vishing. Advances in speech synthesis mean attackers can clone voices with minimal audio samples. Group IB notes that today's deepfake voices bypass traditional voice filters and can trick employees into wire transfers because they appear so genuine. In Asia Pacific, Group IB reports AI-related fraud attempts surged 194% in 2024, and a survey it cites says over 10% of financial institutions had individual deepfake cases costing more than $1M. In the U.S., IC3 logged 22,364 AI-related complaints with $893M in losses in 2025.

Phishers also combine channels in hybrid attacks. A common scheme starts with a bogus email e.g. fake invoice or alert then follows up with a call from support to harvest info. These TOAD Telephone Oriented Attack Delivery attacks are on the rise: Fortra saw hybrid email+voice vishing reach 6.1% of the attacks it recorded in Q4 2023, after rarely seeing it before 2023. The idea is to build credibility via one channel and then exploit another. Fake Geek Squad renewal emails are a consumer version of this pattern, and our guide explains what to do if you called the number.

Myth vs Fact Vishing Edition

• Myth: Vishing is easy to spot because scammers never know personal details.Fact: Modern vishers gather info online or clone voices, making scams very convincing. They often reference real recent events e.g. order shipments, COVID 19 programs to seem legitimate.
• Myth: Only seniors fall for phone scams.Fact: While older adults are heavily targeted, younger adults often slip up too. Truecaller's 2024 survey found adults 18-44 were three times more likely than those 45+ to have lost money to a phone scam in 2023.
• Myth: Caller ID spoofing protections make vishing rare. Fact: Vishing still works because many people trust numbers or use landlines. Even with new ID authentication standards, the volume of spoofed calls is high.

How to Prevent Vishing Attacks: A Step by Step Guide

For UK teams validating voice-phishing response workflows, defending against vishing requires training, technology, callback verification, incident response, and repeatable escalation processes. Follow these steps to bolster your defenses:

1. Employee Awareness Training: Conduct regular training that includes voice phishing scenarios. Use vishing simulation tools to test and reinforce learning. Effective programs cut susceptibility sharply: KnowBe4's 2026 benchmark saw phish-prone rates in email simulations fall from 33.2% to 4.2% after 12 months of training.
2. Phishing Scale Metrics: Use the NIST Phish Scale to rate call difficulty and tailor your simulations. Calibrate training starting from simple scripts low difficulty to highly personalized calls-high difficulty.
3. Verify Before You Trust: Establish a strict verification process: e.g., callback known company numbers instead of using a provided one. Train staff to never give out personal or financial info over an unsolicited call.
4. Multi Layered Security: Implement call blocking and robocall filtering technologies at the network level. Use behavioral analytics to flag unusual call patterns, such as repeated requests for wire transfers. Where call recording and transcription are authorized, an ASR model suited to the languages and accents involved can generate searchable transcripts, helping security teams review suspected scam scripts and urgent payment requests. Transcripts support investigation but do not verify a caller’s identity.
5. Incident Response Plan: Have a clear vishing incident response plan. This should cover how employees report suspicious calls, how IT investigates, and how to notify affected parties. Integrate this into broader cybersecurity and compliance procedures e.g. HIPAA/PCI/DORA regulations may require this.

Performing penetration testing that includes phone based social engineering is also critical. Structuring it as a Red Team vs Blue Team exercise means the calls expose weak spots in your human defenses while the SOC is measured on whether it noticed. By embedding these scenarios in tests, you learn how real attackers exploit phone channels.

How to Defend Against Vishing Attacks

Training lowers the chance that one person falls for one call. The examples above, though, succeeded because a single phone conversation could reset a password, approve a login, authorize an app, or move money. The most reliable defense is to take that power away from the phone call. Map every workflow a caller could abuse, then add a control that a convincing voice cannot satisfy.

Use this table to check the workflows vishers target most:

Of these, phishing-resistant MFA does the most work, because it stops credential relay, push approval, and code theft at once. CISA's guide to implementing phishing-resistant MFA explains the FIDO and PKI options and how to prioritize accounts. Where push MFA remains, number matching and limits on repeated prompts reduce MFA fatigue.

Detect and respond to vishing quickly

Assume some calls will get through and watch for what follows them: help desk resets followed by a sign-in from a new device, new MFA device enrollments, OAuth or connected app grants, large data exports, and payee changes. Make reporting a suspicious call quick and blameless, and route those reports to the SOC rather than a general inbox. Then fold vishing into your incident response plan with steps to revoke sessions, reset factors, and warn colleagues who may receive the same call.

Test the workflows, not just the people

A vishing test is useful when it shows which verification step failed, not who picked up the phone. Scope authorized pretext calls against the help desk reset, payment change, and MFA enrollment workflows, with written approval, agreed pretexts, recording only where consent and law allow, and results reported by process rather than by name. DeepStrike's penetration testing services include social engineering tests such as phishing and phone-based calling, so you can check whether these controls hold before an attacker does.

Vishing is a rapidly growing cyber threat that demands attention. The statistics above rising incident counts, soaring losses, and advancing attack methods show that voice phishing is no longer a fringe issue. Organizations and individuals must stay vigilant.

Key Takeaways:

• Voice phishing incidents are climbing dramatically. Losses are already in the billions annually.
• AI enabled deepfakes have made vishing far more convincing and dangerous.
• Training and testing are effective countermeasures. Companies that invest in staff awareness see phishing click rates drop sharply while reducing their risk.

Ready to Strengthen Your Defenses? The threats of 2026 demand more than just awareness; they require readiness. If you're looking to validate your security posture, identify hidden risks, or build a resilient defense strategy, DeepStrike is here to help.

Our team provides clear, actionable guidance to protect your business. Explore our penetration testing services to see how we can uncover vulnerabilities including vishing before attackers do. Drop us a line we’re always ready to dive in.

About the Author: Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.

FAQs

• What is the difference between vishing, phishing, and smishing?
  • All three are social engineering scams but use different media. Phishing uses email, smishing uses SMS/text, and vishing uses voice calls.
  • Vishing can feel more urgent because it involves live conversation, making it harder to ignore.

• Why are vishing attacks increasing now?
  • Vishing is rising because phone scams are lucrative and trust in calls remains high. Advances in AI voice cloning make scams easier to pull off.
  • Criminals have also adapted post pandemic, exploiting the remote work environment and overtaxed support lines.

• How can I recognize a vishing call?
  • Common red flags include unsolicited requests for sensitive info, high pressure language act now!, and offers that sound too good.
  • Also watch for caller ID spoofing numbers you know but the call doesn’t match. If asked to pay by gift card or cryptocurrency, that’s a scam.

• How do I report a vishing incident?
  • If you believe you’ve been targeted by vishing, report it immediately to the FBI’s IC3 Internet Crime Complaint Center.
  • You can also notify your local authorities and regulators e.g. FTC in the U.S., Action Fraud in the U.K..
  • Many banks and telecoms have anti-fraud hotlines as well. You can also file a complaint with the FBI's IC3.

• What is a TOAD attack?
  • TOAD Telephone Oriented Attack Delivery is a hybrid scam combining email and phone.
  • The attacker might send a phishing email and then follow up with a convincing phone call about that email.
  • According to APWG, hybrid vishing is an emerging tactic: Fortra saw it in 6.1% of the attacks it recorded in Q4 2023.

• Are deepfake voices a real threat in vishing?
  • Yes. Scammers can now clone any voice to sound like a boss or relative.
  • According to industry reports, deepfake vishing scams have caused million dollar losses for businesses.
  • Always verify surprising requests like urgent wire transfers through a second channel, even if you hear your CEO’s voice.

• Does HIPAA or GDPR cover vishing?
  • While not named explicitly, GDPR/HIPAA frameworks expect organizations to protect personal data and train employees.
  • Failing to defend against vishing leading to breaches of health or personal info can be seen as non compliance.
  • HIPAA requires security awareness training and GDPR requires appropriate security measures; vishing awareness is a reasonable part of both.
  • See our HIPAA penetration testing checklist for guidance on including social engineering.