Data Structure
Networking
RDBMS
Operating System
Java
MS Excel
iOS
HTML
CSS
Android
Python
C Programming
C++
C#
MongoDB
MySQL
Javascript
PHP
Physics
Chemistry
Biology
Mathematics
English
Economics
Psychology
Social Studies
Fashion Studies
Legal Studies
- Selected Reading
- UPSC IAS Exams Notes
- Developer's Best Practices
- Questions and Answers
- Effective Resume Writing
- HR Interview Questions
- Computer Glossary
- Who is Who
What is a Vishing Attack? Definition, Techniques, Examples
Social Engineering
Cybercriminals employ social engineering as a deception strategy to persuade individuals to provide personal information. Social engineering depends on the inherent human sense of trust to steal personal and business information that may be utilised to perpetrate future cybercrimes.
What is Vishing?
Vishing is a sort of cybercrime that involves obtaining personal information from victims over the phone. Cybercriminals use devious social engineering tactics to persuade victims to pass up sensitive information and bank account credentials. This is referred to as "voice phishing."
Vishing, like phishing and smishing, depends on convincing victims that answering the caller is the proper thing to do. The caller will frequently impersonate the government, the tax department, the police, or the victim's bank.
Cybercriminals make victims feel as though they don't have any choice but to deliver the information requested by using threats and persuasive language.
Some cyber criminals employ threatening rhetoric, while others claim to be assisting the victim in avoiding criminal penalties. Another frequent strategy is to make threatening voicemails warning the listener that if they don't call back right away, they risk being jailed, having their bank accounts frozen, or worse.
How Does Vishing Work?
More than merely dialing random phone numbers are required for a successful vishing attack; hackers utilise a systematic strategy to steal from victims −
Cybercriminal begins by conducting research on their intended victims. Sending phishing emails in the hopes that someone would respond and reveal their phone number is one example. Alternatively, the offender may use specialized software to dial several numbers with the same area code as the victims.
The victim is unlikely to be sceptical of the caller if they have already been duped by a phishing email. The victim is anticipating a phone call, depending on how sophisticated the phishing/vishing technique is.
People are more inclined to take calls from numbers with a local area code, which hackers are aware of.
Once the cybercriminal gets the victim on the phone, they will appeal to the victim's human impulses of trust, fear, greed, and a desire to assist. The criminal may utilise all or just one of these social engineering strategies to persuade the victim into thinking that they are doing the right thing, depending on the vishing plan. The cybercriminal may request bank account information, credit card information, and a postal address, as well as action from the victim, such as money transfers, emailing confidential work-related documents or disclosing information about their company.
Cybercrime isn't over yet. The cybercriminal can now go on to perform other offences now that they have this information. For instance, a cybercriminal may deplete the victim's bank account, conduct identity theft, and use the victim's credit card information to make illicit purchases, then email the victim's coworkers in the hopes of duping someone into divulging confidential work information.
Vishing Techniques
War Dialing − The cybercriminal use software to dial specific area numbers with a message involving a local bank, company, police agency, or other local entity. When the phone is answered, an automated message asks for the person's full name, credit card number, bank account number, postal address, and even social security number. This information may be required to prove the victim's account has not been compromised or to validate actual account data, according to the recorded message.
VoIP − Cybercriminals may quickly generate bogus phone numbers and hide behind them, thanks to VoIP.These numbers are difficult to trace and are frequently used to create phone numbers that appear to be local. Some hackers would construct VoIP numbers that seem like a government agency, a local hospital, or the police department.
Caller ID Spoofing − Caller ID spoofing is similar to VoIP vishing in that the cybercriminal hides behind a false phone number/caller ID. They may use an unknown caller ID or claim to be a genuine caller by utilising a caller ID such as Government, Tax Department, Police, etc.
Dumpster Diving − Digging through the trash behind banks, office buildings, and other random institutions is an essential yet common means of acquiring genuine phone numbers. Criminals frequently gather enough information to launch a targeted spear vishing assault on the victim.
Vishing Examples
Government Representative − The caller claims to be from the government and is only phoning to check personal identity information. If the victim does not supply the information necessary to validate their account and identity, the caller may threaten to delay tax returns or social security payments.
Tech Support Fraud − The caller poses as Microsoft, Amazon, or the local cellular provider's tech assistance. They've spotted strange activity on the victim's account and want to double-check that they have the correct account information. The cybercriminal may request an email address to send a software update to the victim, instructing them to install it to safeguard their computer from cybercriminals. However, this installs malware on the victim's machine.
Bank Impersonation − The cybercriminal appears to be phoning on behalf of the victim's bank by using a faked phone number and caller ID. The caller claims that there have been odd activity on the victim's account and requests that the victim confirm their bank account information, as well as their mailing address for identification purposes. The cybercriminal then uses this information to perform identity theft.
Telemarketing Attack − Everyone loves to win a free reward, and cybercriminals take advantage of this desire to deceive unwary victims into disclosing personal information. The caller states that this information is essential to handle the free prize and ensure that it is delivered on time to the victim.
383 Views
