To prevent vishing, make sure a phone call alone can never get anything done. Check requests through a channel you pick, never share a code over the phone, and don’t allow account resets on the strength of a call.
Trying to “spot the scam” is the weak spot. Good callers sound completely normal. In the cases below, the controls that worked, or would have, didn’t rely on anyone noticing something was off.
| Attack stage | Control that breaks it | Case that shows why |
|---|---|---|
| 1. Research | Facts someone could look up don’t count as proof of identity | Retool (2023) |
| 2. First contact | Ignore caller ID. Call back on a number you found yourself | Barclays impersonation (2024) |
| 3. The ask for a code | Codes are never shared by phone. Move to FIDO2 keys | Optus and TPG (2023 to 2024) |
| 4. The reset request | No password or MFA reset just because someone called | Clorox (2023, alleged) |
| 5. The login prompt | MFA nobody can be talked through: number matching or keys | Twitter (2020), Uber (2022) |
| 6. Remote access | Nobody installs remote-access software for a caller | Barclays impersonation (2024) |
| 7. The payment | Money only moves after a callback you made | UK energy firm (2019) |
Key takeaways
These callers do their homework. The FBI and CISA advisory on Scattered Spider says the group builds profiles from social media, open-source information, commercial intelligence tools and data leaks. Retool’s caller knew the office floor plan, coworkers and internal processes.
So someone who knows a manager’s name, an employee number or a recent project hasn’t proved a thing. Identity checks, for staff or customers, need something a stranger can’t look up. A callback to a number already on file is the simplest.
In the Barclays impersonation case, a UK jeweller checked the callback number online and recognized the bank’s hold music. Both were faked. In a Bank of America impersonation case, the incoming number matched the one printed on the victim’s card.
The fix is a habit, not a judgment call. Hang up. Dial a number you found yourself, on the card, a statement, the company directory or the official app. Don’t use any number, reference code or website the caller gives you.
A one-time code only protects an account while it stays with its owner. At Retool, an employee gave a second code to a caller pretending to be IT, and that let the attacker add their own device to the account. In the Optus and TPG case, Australian police allege callers got the PINs that authorized phone purchases on victims’ accounts.
Make it a hard rule for staff and customers alike: no genuine caller needs your code. For staff, phishing-resistant MFA like FIDO2 security keys or passkeys takes the code out of the picture, so there’s nothing to hand over.
The help desk is where one phone call can open up a whole company. The FBI and CISA advisory describes calls placed to “convince IT help desk personnel to reset passwords and/or transfer MFA tokens.”
In the Clorox help-desk case, Clorox alleges its outsourced service desk reset passwords and MFA, and changed the phone number used for text-message MFA, just because a caller asked. Clorox says its written procedure called for a self-service reset tool, or a manager check with confirmation emails, and that agents skipped it. Those are allegations. Cognizant says it carried out a narrow help-desk role reasonably, and no court has found it liable.
A sound reset process needs proof the caller can’t talk around. That might be a callback to the number on file, a manager’s approval in a separate system, or a self-service reset behind strong authentication.
Watch for repeat resets on one account, too. The Clorox complaint describes three calls about the same account in one day.
A push notification that just says “approve” can be approved for the wrong person. In the 2020 Twitter hack, callers sent staff to a fake VPN page, and some of them approved the MFA prompt that came next. New York regulators concluded hardware MFA “would have stopped the Hackers.”
At Uber in 2022, an attacker with a contractor’s password kept firing login approvals until the contractor accepted one. Number matching, where you type a code shown on the login screen, takes the sting out of repeated prompts. Security keys stop the relay completely. And alert on any new device added to an account. That was the step that gave Retool’s attacker lasting access.
The jeweller in the Barclays case was talked into installing AnyDesk and told his screen would go blank as part of the fix. Meanwhile GBP 48,451.78 left two business accounts. A real bank fraud team doesn’t need control of your computer.
On company devices, block remote-access tools IT hasn’t approved. For everyone else it’s simple: if a caller asks you to download something, the call’s over.
In 2019, the CEO of a UK energy firm wired €220,000 after a call that reporting says used AI to imitate his parent company’s chief executive. It came apart when a promised repayment never showed up and another call came in from an Austrian number, which led him to contact the real executive.
Bank of America says it will never call a client and ask them to send money by Zelle or wire. For businesses, any new payee or urgent transfer should need a callback on a stored number and a second approver. No exceptions for seniority or secrecy.
Awareness helped, but it wasn’t enough. At Retool, the employee got more suspicious as the call went on and handed over a code anyway. At Twitter, New York regulators found some employees reported the calls while others were taken in.
What actually worked was a step in a process. In a 2025 Saskatchewan grandparent scam, one targeted senior rang the real lawyer whose name the scammers had borrowed, and found out it was a scam. Her report helped police arrest the two people collecting the cash.
Hang up without confirming anything, even details the caller seems to know already. Then contact the organization on a number you look up yourself, and report the call: at work to your security team, and in the US to the FBI at ic3.gov. A genuine caller won’t mind you calling back, so pressure to stay on the line is a warning sign in itself.
Some of them. Phone carriers and call-filtering apps can stop some known scam numbers. But spoofing lets a caller show a number you trust, as the Barclays and Bank of America impersonation cases show. Blocking cuts down the number of calls. It doesn’t replace the callback rule, which works no matter what number shows up on screen.
Only with proof the caller can’t supply just by talking. That means a callback to the number already on file, approval from the employee’s manager in a separate system, or a self-service reset behind strong authentication. Changes to the phone number used for text-message codes need the same care, since the Clorox complaint alleges that change handed the attacker the second factor.
Move fast. Call your bank or IT team on a number you trust, change the password, and ask for active sessions to be revoked and any transfer recalled. There’s no guarantee. Bank of America told reporters it tries to recover funds but can’t promise it once a client has authorized a transfer. In the Barclays case, the victim’s law firm later got GBP 25,650 back.
Usually from places you can’t fully control. The FBI and CISA describe one group using social media, open-source information, commercial intelligence tools and data leaks to profile targets before calling. In a lot of consumer cases, nobody ever finds out where the number came from. Since what the caller knows proves nothing, check the request, not how familiar the caller sounds.
Reviewed by SEE Team. Last reviewed 21 Oct 2026. How pages are researched and fact-checked. About Social Engineering Examples.
Social Engineering Examples