Let's now look at a not-so-rare scenario. You are a user of a social networking platform. You click on a link and the screen automatically turns blue, while a warning message appears urging you to call a toll-free number to repair your serious computer problem. You call it and a very kind technician answers and promises to fix everything completely, for a fee of course. Then, you give your card details to pay for the software that will "save" you. Of course, the software doesn't work and the technician disappears. You have just become a victim of vishing.
Vishing is a form of attack that uses verbal means to convince users that they need to do something specific to solve a computer. Vishing is often a continuation of phishing.
The link that users click on is usually an online advertisement related to their personal interests. The malware was already installed on the link and upon clicking it locks the system and only the malicious technician can undo it.
But how common are vishing attacks ?
Overall, attacks targeting credit cards worldwide in 2015 cost $16 billion. Vishing reached $1 billion. Essentially, such an attack can occur anytime a hacker gains access to a victim's personal information.
Vishing works best when cybercriminals know little about a user's interests. They create a sense of urgency to solve a problem and trick them into thinking they're going to do it.
What are the signs that will alert you to vishing?
If the “technicians” are legitimate, it shouldn’t be difficult to verify their professional identity with a simple phone call. If they can’t or won’t provide the necessary information to verify their identity, they’re not trustworthy. If they do provide contact information, it’s still important to verify their identity by using a public phone number to call the organization in question.
It is completely understandable that during an emergency, the mind becomes foggy. This is why it is important to remain calm and immediately record the technician's information, without giving it to the user.
It is very important that there is no response to the technician's subsequent actions, such as SMS or emails, because this is likely a continuation of vishing.
We must not forget that a technician who is actually attempting to save a computer from malware will strongly advise the user to change account passwords, notify banks and credit card companies, and closely monitor financial transactions.
