Voice phishing: what to do while it is happening

The first two minutes, in order

That is the entire defence. The rest of this page explains why it works, so it is easier to do next time.

What these calls sound like

They are not all the same script, but they are the same shape, and the shape is easier to recognise than any individual story.

The opening establishes authority. A fraud department, a police officer, a courier firm, a tax office, a technical support desk. Often the caller offers a detail about you first, unprompted, because being told something correct is what makes a stranger sound official.

Then comes a threat with a clock on it. An account is being emptied right now. A warrant has been issued. A parcel will be destroyed. A refund expires today. The specific claim matters less than the fact that it cannot wait, because waiting is the thing that would destroy it.

Next, the caller takes charge of what you may do. Do not discuss this with anyone. Do not go into a branch, the staff there are being investigated. Stay on the line while you carry out the instructions. Isolation is not incidental to these calls; it is the mechanism.

Very often there is a handover. The first voice passes you to a supervisor, an inspector, a case officer, a solicitor. That second person is calm and does the actual asking. The handover exists because it moves the conversation to a voice you have no reason to recognise, so nothing more needs to be imitated.

Where a relative is being impersonated, the call is shorter and much more upsetting, and it is covered properly in the guide to the family emergency call. A caller claiming your bank is moving your money to a safe account is its own pattern with its own answer.

What the call is trying to obtain

Almost every voice phishing call ends at one of a small number of destinations. Recognising the destination is faster than assessing the story.

• A payment you make yourself. A transfer to a “safe account”, a bill settled urgently, a fine, a bail payment. Banks call this authorised push payment fraud, and the phrase is worth knowing because it is what you should say when you report it.
• A one-time code. Read out from a text message or an app. No genuine organisation needs a code you were sent. The code exists specifically to prove that a request came from you.
• Approval of a prompt on your phone. A caller who keeps you talking while notifications arrive is waiting for you to approve a login you did not start.
• Remote access. Being talked through installing an app so somebody can “fix” or “secure” something. This hands over the device your banking lives on.
• Untraceable value. Gift card numbers, vouchers, cryptocurrency, cash collected by a courier. Nothing legitimate is ever settled this way.

If a call is heading for any of those, the story wrapped around it is irrelevant. Stop and verify.

Five things that feel like proof and are not

People do not fall for these calls because they are careless. They fall for them because several things in the call look like verification and none of them is.

The number on your screen. Caller display is a label chosen by the sender, not an address checked by the network. It can read as your own bank.

Knowing your details. Your address, your bank, a recent purchase, your employer. All of it circulates, and being told something true is not evidence about who is telling you.

The hold music and the reference number. Both are trivially easy to produce and both are there to make the call feel institutional.

They rang you back. A caller offering to prove themselves by ringing you again is proving nothing, because they control both calls. Only a number you looked up yourself counts.

The voice. This is the newest one and the hardest to accept. A familiar voice used to be a reasonable signal, and it is not any more, because a likeness good enough for a phone line can be built from about a minute of recorded speech. How that works is worth reading once, calmly, when nothing is going on. Trying to hear the difference during a call is the approach that fails most reliably.

Afterwards, whether or not you paid

If money has gone, ring your bank now and ask for the fraud team. The chance of recovery falls sharply with every hour. Then write down the time, the number that displayed, the names used, any account details you were given, and what was said. Report it to the relevant national body. [VERIFY: correct fraud reporting bodies and URLs for each market before publishing links]

If nothing was lost, it is still worth telling the organisation that was impersonated and telling the people around you, particularly anyone in the family who would be targeted next. These calls are made in batches.

If you have a voicemail or a recording of the call, keep the original file and do not forward it around a group chat first. Each forward re-compresses the audio and strips out the very detail an analysis depends on. Getting a usable recording covers this, and you can then have the file checked. Be clear about what that gives you: a probability afterwards, not protection during. A flag is meaningful because it takes positive evidence; a clean result can simply mean the phone network destroyed the evidence on the way, which is why phone audio is the hardest case we work on.

One thing to fix this week, because it costs nothing: agree a short passphrase with your family, spoken aloud and never typed into a message, that anyone claiming an emergency has to produce. There is a generator here.

If you came here for the terminology

This page is written for someone dealing with a call. The word security teams use for the same thing is vishing, and where that term came from, how it sits beside phishing and smishing, and how the technique is classified in incident reporting are covered in the reference page on vishing. The two pages exist separately on purpose: one is for a person holding a ringing phone, the other is for someone writing a policy or a training module about it.

Questions people ask during and after a call