27 real vishing cases from this library, from the MGM Resorts and Carnival help-desk calls to fake bank fraud teams and police impersonators. For each one: who the caller claimed to be, what it cost, and what would have stopped it.
Vishing, or voice phishing, is a scam run over the phone. The caller says they're from your bank's fraud team, IT support, the tax office or the police, and talks you into handing over a code, a password or money. A confident voice on the phone is harder to doubt than an email, and that's the whole trick.
Key takeaways
In the Standard Bank case, that whole chain took about 20 minutes. An 18-year-old moved R438,900 from her education fund in three transfers, and by the time anyone flagged it the receiving account held R406.
The most common pattern here. "We've spotted fraud on your account, let's move your money somewhere safe." Hamilton Academical FC's banking employee moved about £989,000 into 26 new accounts this way in 2017. A Surrey solicitor moved £734,000 of client money after calls from fake NatWest security staff.
Either the attacker calls the help desk pretending to be an employee, or calls an employee pretending to be the help desk. One call at MGM Resorts led to an outage MGM valued at about $100 million. A call claiming to be Carnival's own IT security team led to the theft of data on nearly 6 million people. See help-desk and MFA manipulation.
Fear does the work. Canada's CRA phone scam, run from call centres in India, threatened people with arrest or deportation over fake tax debts, and the RCMP linked it to over $16.8 million in reported losses from 2014 to 2019. In Singapore, a finance professional lost S$1.2 million after callers posing as the Anti-Scam Centre and then a police inspector told her she was tied to money laundering.
A "grandchild" in trouble, then a fake lawyer or officer. In a Saskatchewan case, the judge concluded AI had been used, though investigators couldn't confirm voice cloning. The earliest widely reported AI voice case here is from 2019, when a UK energy firm's CEO wired €220,000 after hearing what sounded like his parent company's boss. See voice cloning.
Here you make the call. A pop-up, an email or a fake invoice gives you a number, and the "support agent" takes it from there. In one 2026 campaign, attackers used Microsoft's own alert system to send a fake $459.90 billing notice with their callback numbers in it. See callback phishing.
Loss figures keep the basis stated on each case page. Some are measured, some reported, some alleged, so don't add them up.
| Caller claimed to be | Case | What it cost |
|---|---|---|
| An employee, calling IT | MGM Resorts, 2023 | About $100 million hit to a quarterly profit measure, per MGM |
| Twitter's IT help desk | Twitter, 2020 | 130 accounts hijacked, over $118,000 in bitcoin taken from the public |
| Carnival's IT security team | Carnival, 2026 | Personal data on nearly 6 million people |
| The parent company's CEO | UK energy firm, 2019 | €220,000 wired |
| RBS fraud team | Hamilton Academical FC, 2017 | About £989,000 moved, about £800,000 still outstanding |
| Wells Fargo, on its real number | Wells Fargo customer, 2022 | A $100,000 wire, per the lawsuit |
| Barclays fraud team | UK jeweller, 2024 | GBP 48,451.78 taken, GBP 25,650 later recovered |
| Anti-Scam Centre, then police | Singapore, 2024 to 2025 | S$1.2 million |
| Insurance agent, police, prosecutor | Johor Baru, 2026 | RM936,000 in life savings |
| Bank fraud-prevention officers | Los Cyber, Colombia, 2025 to 2026 | COP 1.685 billion from 94 people, alleged |
The full list of 27 is further down this page, with filters for status and country.
| Stage | What helps | Case it would have broken |
|---|---|---|
| The call | Hang up and call back on a number you look up yourself | Wells Fargo, Barclays jeweller |
| The ask for a code | A firm rule: nobody legitimate asks for codes by phone. Phishing-resistant MFA for staff | Twitter, Retool |
| The help-desk reset | Verify identity with something a caller can't research before any reset | MGM, Carnival |
| The transfer | Banks pausing large first-time transfers to new accounts and calling back | Hamilton Academical, Standard Bank |
| The secrecy | Tell family and staff: any caller who says "don't tell anyone" is the scam | Singapore, Johor Baru |
Same trick, different channel. Phishing is email, smishing is a text or chat message, and vishing is a voice call. Attackers mix them. Retool's attacker texted first and then called, and fake billing emails in the callback scams exist mainly to get you on the phone. For the detail, see vishing vs phishing and vishing vs smishing.
Vishing is voice phishing: a scam carried out over a phone call. The caller poses as someone you'd trust, like a bank, IT support or the police, and pushes you to share codes or passwords, install software or move money. The word combines "voice" and "phishing."
In September 2023, an attacker called MGM Resorts' IT help desk pretending to be an employee and got MFA reset. That one call led to an outage MGM valued at about $100 million. The often-repeated claim that it took just ten minutes comes from the attackers and was never independently confirmed.
Yes. Caller ID spoofing is cheap and common. In the Wells Fargo case, the scammer showed the bank's real 800 number nine minutes after a genuine call from the customer's advisor. If a call worries you, hang up and dial the number on your card.
Call your bank on the number you already have and ask them to stop or recall any transfer. Change any password you shared and sign out other sessions. Report it to the police and, in the US, to the FBI's IC3. Speed matters: in the Standard Bank case, the money was gone within a day.
By making identity checks impossible to talk around. Call back a number already on file, get a manager to confirm, or use a video check before resetting a password or MFA. Questions with answers that can be looked up, like an employee ID, don't protect much.
Counts on this page come from the 27 cases tagged vishing in this library on 21 Oct 2026. The library statistics page has the wider picture. Reviewed by SEE Team. Last reviewed 21 Oct 2026. See the methodology, or who publishes this library.
A caller posing as Standard Bank got an 18-year-old to move her R438,900 education fund to a 'safe' account in 20 minutes. What happened and what's disputed.
VIFake Anti-Scam Centre and police officers convinced a Singapore finance worker she was a suspect, then took S$1.2M through transfers and cash handoffs.
VISABRIC recorded R2.4bn in South African digital banking fraud claims in 2025, driven by phishing, fake bank calls and SIM swaps. What the numbers mean.
VIA judge called it an AI-driven fraud, but police couldn't confirm voice cloning. How the Saskatchewan grandparent scam worked and how a lawyer's call cracked it.
VIA fake IT text and phone call got a Retool employee's MFA codes in 2023. Google Authenticator sync did the rest: 27 crypto accounts hijacked. What happened.
VIAn Atlantic City woman called grieving widows posing as a life insurer, demanding gift cards to clear policy "arrears". 17+ victims, $100,000+. How it worked.
VIColombian police say 'Los Cyber' posed as bank fraud staff, got victims to share their phone screens and took COP 1.685 billion from 94 people. 16 charged.
VIMGM Resorts, September 2023. A caller reportedly talked the IT help desk into resetting an employee's access, and the shutdown that followed knocked about $100 million off quarterly property profit. No ransom was paid. Below: what MGM's filings confirm, and what only the attackers said. A documented incident.
VIA retired bank manager in Johor Baru lost RM936,000 after callers posing as an insurer, police and a prosecutor had her move her savings. How Macau scams work.
VIJLR's 2025 cyber attack halted production for five weeks. Early reports blamed help-desk vishing; JLR's CISO later denied it. What's claimed vs what's known.
VIProsecutors say a grandparent scam run from call centers in the Dominican Republic hit hundreds of elderly Americans and took millions of dollars. One caller played a grandchild under arrest. Then a fake lawyer, police officer, or court clerk took over, and couriers in the US picked up the cash. Sixteen people were charged in 2024. Nothing's been proven in court, and there's no itemized loss total anywhere.
VIA caller posing as Carnival's IT security team got an employee's login in April 2026. The attacker copied data on nearly 6 million people. What was taken.
VIAttackers made Microsoft's own Azure Monitor send a fake $459.90 Windows Defender bill that passed SPF, DKIM and DMARC. A reviewer cleared it. How it worked.
VIIn July 2020, callers posing as Twitter IT stole staff logins and hit 130 accounts, from Obama to Musk, with a bitcoin scam. How it worked and how it ended.
Social Engineering Examples