Vishing
Vishing uses phone calls to manipulate victims. Attackers impersonate authorities (IRS, Social Security, banks, tech support) using caller ID spoofing and high-pressure scripts to extract money or information.
1
The Bait
2
The Reveal
3
The Defence
🎣 Phase 1 — The Bait
Your phone is ringing. The caller ID shows "IRS — Tax Enforcement". Read the call transcript below.
IRS — Tax Enforcement
🏛️
+1 (202) 756-6400
Connected
02:34
📋 Call Transcript (Reconstructed)
Attacker
This is Officer James Warren from the IRS Criminal Investigations Division, badge number 4821. This call is being recorded. We have issued a warrant for your immediate arrest due to tax fraud and evasion. You owe $4,312 in back taxes.
You
What? I don't think I owe any taxes…
Attacker
Do NOT hang up. Hanging up will be considered obstruction of justice and will result in immediate law enforcement dispatch to your address. You must stay on this line to resolve this today and avoid arrest.
You
I need to call my lawyer…
Attacker
You can retain counsel AFTER you pay the outstanding amount. This is a federal matter. To avoid arrest today, you must go to a CVS or Walgreens right now and purchase $4,312 in Google Play gift cards. Call us back with the card numbers to settle the debt and clear the warrant.
🔍 Phase 2 — Social Engineering Tactics Annotated
Every line of the vishing script is a calculated psychological manipulation. Here's the breakdown.
🔬 Annotated Vishing Script
Tactic
"Badge number 4821… this call is being recorded"
Authority
Fabricated credentials create a false sense of legitimacy. Badge numbers and "recording" pressure make victims feel they're in an official legal process.
Fabricated credentials create a false sense of legitimacy. Badge numbers and "recording" pressure make victims feel they're in an official legal process.
Tactic
"Warrant for your immediate arrest"
Fear
Triggering fear of imprisonment shuts down rational thinking. Victims act to avoid the perceived threat rather than verify it.
Triggering fear of imprisonment shuts down rational thinking. Victims act to avoid the perceived threat rather than verify it.
Tactic
"Do NOT hang up… obstruction of justice"
Isolation
Keeping the victim on the line prevents them from consulting family, friends, or their bank who would immediately flag the scam.
Keeping the victim on the line prevents them from consulting family, friends, or their bank who would immediately flag the scam.
Tactic
"Go to CVS NOW… gift cards"
Urgency
Government agencies and law enforcement never accept gift cards as payment. This is the single biggest tell. Gift cards are untraceable and non-refundable — perfect for scammers.
Government agencies and law enforcement never accept gift cards as payment. This is the single biggest tell. Gift cards are untraceable and non-refundable — perfect for scammers.
🚩
Caller ID Is Spoofed
The real IRS number (+1 202 756 6400) was spoofed using VoIP tools costing less than $5/month. Anyone can make any number appear on your caller ID. The IRS will always send written notice by post before any call.
🚩
The IRS Will Never:
• Call to demand immediate payment without first mailing a notice
• Threaten to call police or immigration for non-payment
• Demand payment via gift cards, wire transfer, or cryptocurrency
• Ask you to stay on the line and not consult an attorney
• Threaten to call police or immigration for non-payment
• Demand payment via gift cards, wire transfer, or cryptocurrency
• Ask you to stay on the line and not consult an attorney
🛡️ Phase 3 — Defending Against Vishing
- Hang up immediately if someone claims urgency, threatens arrest, or demands gift card payment. These are 100% scam indicators.
- Do not trust caller ID — it is trivially spoofed. Call back official numbers listed on the agency's official website.
- Government agencies (IRS, SSA, HMRC) always send official written notices before calling. They don't cold-call with threats.
- No legitimate authority ever accepts payment via gift cards, wire transfer, or cryptocurrency for legal debts.
- You always have the legal right to consult an attorney before responding to any legal matter — anyone saying otherwise is lying.
- Use call blocking apps (Hiya, Truecaller) to filter known scam numbers automatically.
- Report vishing attempts to the FTC at reportfraud.ftc.gov (US) or Action Fraud (UK).
Vishing Attack Variations
🏦 Bank Fraud Alert
"Your account is compromised — verify your card details NOW to freeze it."
💻 Tech Support Scam
"Your computer has a virus. Allow remote access and pay $299 to fix it."
🏛️ SSA Suspension
"Your Social Security number has been suspended due to illegal activity."