Move Over Phishing, Here Comes ‘Vishing’

Secure Computing has reported an ingenious new type of phishing scam that uses VoIP telephony to entrap its victims.

Dubbed “vishing,” the fraud sees randomly dialed users phoned by an automated system to be told that their credit card has been used illegally.

They are then asked to dial a fake 1-800 telephone number, which accesses a system requesting they confirm their account details and credit card number. Armed with this information, criminals then empty the victim’s account by buying products and services on the card.

A clutch of phone-based scams have suddenly come to light in the past month, but this one is one of the most advanced for the way it uses the features allowed by VoIP to disarm the suspicions of contacted subjects.

According to Secure Computing, the call return number is spoofed to appear as a regional telephone number of the financial institution the criminals are pretending to represent, a feint that is much easier to pull off on VoIP than it would be on a conventional PSTN. The real VoIP number could be anywhere in the world.

Because the scam is carried out offline, it represents a form of social engineering that no computer security system can stop. Once a credit card customer has fallen for the story—and it is quite possible that average account holders will be less suspicious of phone contact than they would be of the same message received via e-mail—they are heading for an empty account.

“Like most other social engineering exploits, vishing relies upon the hacking of a common procedure that fits within the victim’s comfort zone,” said Secure Computing’s Paul Henry.

As a matter of course, customers should be highly suspicious of any phone or e-mail contact that does not use their first and surnames, and should never dial a call-return number or reply to an e-mail regarding any financial matter.

Significantly, the so-called “vishing” phenomenon is an example of a growing number of frauds that have first come to light on security discussion groups rather than through detection by security companies.

-John E. Dunn, Techworld.com (London)

Keep checking in at our CSO Security Feed page for updated news coverage.