Vishing: How to spot attempted fraud over the phone

Contents:

• What is vishing and what lies behind this scam?

• How does vishing work and why do the calls seem so credible?

• Which vishing scams are particularly common?

• Spotting vishing: 6 warning signs you should be aware of

• Suspicious call: How to react at the right moment

• If someone on the phone claims to be from your bank

• How to further enhance the security of your Swiss Bankers card

• Fallen victim to vishing: these are the important steps to take now

• Conclusion: When it comes to suspicious calls, it’s better to hang up just to be on the safe side

What is vishing and what lies behind this scam?

The term ‘vishing’ is a portmanteau of the words ‘voice’ and ‘phishing’ and refers to phishing carried out via telephone or voice calls. Whilst traditional phishing attacks often take place via fake emails or websites, in vishing, criminals attempt to manipulate their victims directly during a conversation.

To do this, they pose as trustworthy individuals or employees of well-known institutions and companies. The aim is, for example, to obtain personal information, passwords, card or login details and security codes, or to persuade victims to make a payment or carry out other security-related actions.

Vishing is therefore a form of so-called social engineering: rather than directly attacking technical security mechanisms, the perpetrators attempt to influence people in a targeted manner. If a similar phishing attempt is carried out via text message, it is referred to as ‘smishing’.

How does vishing work, and why do the calls seem so credible?

Vishing relies primarily on trust, surprise and time pressure. Callers often describe a situation that appears to require immediate action: an unusual payment needs to be stopped, an account needs to be protected or a technical problem needs to be resolved urgently.

This leaves little time to question the story. What’s more, the fraudsters sometimes already possess personal information about their victims. This may, for example, stem from previous phishing attacks, data breaches or publicly available sources. If the caller knows the person’s name, employer or even their bank, the call can quickly seem credible.

Even the displayed telephone number offers no reliable guarantee of security. In what is known as ‘caller ID spoofing’, the telephone number is manipulated. As a result, the display may show, for example, a Swiss telephone number or even what appears to be the official number of a bank or company.

Which vishing scams are particularly common?

The person behind a vishing call can be anyone. Fraudsters often pose as callers whom the person being called would normally trust.

• Pseudo-bank staff: The caller may, for example, claim to have detected a suspicious transaction. To stop this, the victim is asked to provide login details or security codes, confirm an action in an app, or grant remote access to their device.
• Fake technical support: People posing as employees of a technology company warn of a security issue on a computer or smartphone. The victim is then asked, for example, to install remote access software. This allows the perpetrators to gain access to the device and, in some cases, to sensitive data.
• Alleged government agencies or police: Government agencies and police forces are also used as supposed senders. In the case of automated calls, for example, the caller may claim that the person being called is linked to a criminal offence. By pressing a key, the person is then put through to a supposed member of staff.
• Well-known companies and service providers: Vishing can also build on a previous contact. For example, a fake message or website may be followed by a call from a supposed employee of the company in question, who claims to want to ‘help’ with an alleged problem.

These methods can be interlinked. The Federal Office for Cyber Security (BACS), for example, has observed two-stage attacks in which information such as telephone numbers and bank details is first collected via a phishing website. The perpetrators then contact the victim by telephone, posing as employees of that very same bank.

Spotting vishing: 6 warning signs you should be aware of

Vishing calls can take many different forms. However, there are certain characteristics that should raise your suspicions:

1. The call comes out of the blue.
A supposedly trustworthy person or organisation suddenly contacts you about an urgent issue.

2. Unusually intense time pressure is applied.
You are told to react immediately, otherwise you face, for example, financial loss, your account being blocked or other consequences.

3. Confidential information is requested.
For example, you are asked to disclose passwords, PINs, card details or security or one-off codes.

4. You are asked to confirm an unknown action.
You are asked to authorise a payment, registration or other request that you did not initiate yourself.

5. You are asked to install software or grant remote access.
You should be particularly cautious if an unknown caller wants to gain access to your computer or smartphone.

6. The telephone number displayed is intended to inspire trust.
Even a number that appears familiar or official is no guarantee that the call is genuine. Telephone numbers can be manipulated.

Suspicious phone call: How to react at the right moment

If a call seems suspicious, the most important thing is not to let yourself be pressured. Follow these steps to stay on the safe side:

1. End the call. If in doubt, hang up – even if the caller already knows personal information about you or the number displayed appears trustworthy.
2. Do not disclose any confidential information. Do not give out passwords, PINs, card details or security codes. Do not confirm any unknown payments or registrations, and do not install any software at the caller’s request.
3. Verify the call independently. Contact the relevant bank, public authority or company yourself. Only use contact details that you have obtained from an official website, app or other trustworthy source.
4. Report the suspicious call. You can report suspicious cyber incidents to the Federal Office for Cyber Security (BACS). If you have already suffered financial loss, you should also report the matter to the police.

Important: Even a familiar telephone number or personal information that the caller has about you is no proof that the call is genuine.

If someone claims to be from your bank over the phone

Banks and card providers may well contact their customers – for example, if a suspicious transaction has been detected. A call from your bank is therefore not automatically an attempt at fraud.

The key factor is what information or actions you are being asked to provide. Do not disclose any confidential authentication details such as PINs, passwords or security codes over the phone. Swiss Bankers and Mastercard do not ask customers to disclose, change or confirm personal details such as card numbers, expiry dates, card security codes, usernames or passwords.

If, for example, you are asked during a call to provide such details, to authorise an unknown payment or to grant a stranger access to your device, end the call immediately. Then contact Swiss Bankers yourself using the official contact channels.

How to further enhance the security of your Swiss Bankers card

By adjusting a few settings in the Swiss Bankers app, you can provide extra protection for your card and spot suspicious activity more quickly:

1. Enable push notifications. This will keep you informed of any transactions made and help you spot unauthorised charges more quickly.
2. Check your transactions regularly. Check your card account for any unknown or unusual charges and respond to any discrepancies as soon as possible.
3. Customise your card’s features to suit your needs. For example, you can use the app to disable contactless payments or use geoblocking to block payments in specific regions. If you only use your card occasionally, you can block it in the meantime and unblock it again when needed.
4. Check online payments carefully. Mastercard Identity Check offers additional protection for relevant online payments through two-factor authentication. Nevertheless, only confirm payments and transactions that you have initiated yourself.

Even just a few security settings can help you spot unusual card activity more quickly and tailor your card’s usage to your personal needs.

Fallen victim to vishing: these are the important steps to take now

If you have already disclosed any data, confirmed a payment or granted a fraudster access to your device, you should act as quickly as possible:

1. Secure any affected accounts and devices. Change any passwords and login details that may have been compromised. If you have installed remote access software at the fraudster’s request, first disconnect the affected device from the internet and, if in doubt, have it checked by an expert.
2. Contact your bank or payment service provider. If money has already been transferred or payment details have been compromised, contact the relevant provider immediately.

3. Take action if a Swiss Bankers card is affected. Arrange for your card to be blocked immediately and report the suspected fraud to Swiss Bankers customer service. Alternatively, you can use the Swiss Bankers app directly: if you select the ‘Replace card’ self-service option there, the relevant process will be initiated automatically. In this case, it is not necessary to block the card manually.

4. Check for and report any unknown transactions. Check your transaction history for any unauthorised charges. You can dispute any fraudulent transactions that have already taken place by using the relevant form on the Swiss Bankers website.

5. Report the fraud. Suspicious cyber incidents can be reported to BACS. If you have suffered financial loss, you should also report the matter to the police.

The quicker you react following a successful vishing attack, the sooner further unauthorised access or transactions can be prevented.

Conclusion: If you receive a suspicious call, it’s better to hang up just to be on the safe side

Vishing works primarily because fraudsters build trust whilst simultaneously applying pressure. They may pose as bank staff, government officials or employees of well-known companies. Therefore, do not let yourself be pressured into making hasty decisions when you receive unexpected calls. Do not disclose any confidential information and do not confirm any transactions that you have not initiated yourself. If a call seems suspicious, hang up and contact the person or organisation in question yourself via an official channel.