AI Vishing: How It Works, Why It’s Dangerous, and How to Stop It

Key takeaways

1. AI vishing uses cloned voices to impersonate people you trust over the phone, tricking employees into sharing credentials, MFA codes, or sending company funds.
2. Major companies are being hit right now. In 2026, Google's Threat Intelligence Group linked vishing gangs to attacks targeting Apollo, Blackstone, KKR, Bain Capital, and other top financial firms, with ransom demands of $750,000 to $3 million.
3. You cannot rely on instinct alone. A UC Berkeley study found people mistake a cloned voice for the real speaker about 80% of the time.
4. Vishing is now the top phishing threat security teams see. Cisco Talos reported it made up over 60% of all phishing-related incident response engagements in Q1 2025.
5. The fix is process, not detection. Callback verification, two-person approval, and realistic simulation training close the gap that voice recognition alone cannot.

What is AI vishing?

AI vishing (AI-powered voice phishing, aka deepfake vishing) is a social-engineering attack where threat actors use artificial intelligence, usually voice cloning or live conversational AI, to impersonate a trusted person over the phone. They do this to manipulate a victim into transferring money, resetting credentials, granting system access, or sharing sensitive data.

Vishing vs. AI vishing vs. phishing vs. callback phishing

Vishing and phishing attacks target their own specific channels: email, phone calls, AI-generated voice calls, and text. Here’s a handy summary to help you understand what kind of scam you’re dealing with:

• Phishing happens over email. AI's role is generating personalized copy at scale. Common pretexts: fake invoices, credential reset links, security alerts.
• Vishing (traditional) happens over a phone call with a human scammer, no AI involved. Common pretexts: a bank advisor or fraud investigator.
• AI vishing happens over a phone call, with AI providing a cloned or synthetic voice and real-time adaptive responses, usually built by gathering intelligence from a target's online presence. Common pretexts: a CEO, manager, or colleague impersonation.
• Callback phishing (TOAD) happens over email or text, followed by a phone call the victim initiates themselves. AI's role is writing the personalized lure that drives the callback. Common pretexts: a fake subscription renewal or helpdesk ticket.

Deepfake vishing specifically implies a cloned voice. AI vishing is the broader category that also covers AI-written scripts, live conversational agents, and AI-assisted OSINT targeting, even when no voice is cloned at all.

For a closer look at how AI is changing the phishing game, check out our guide to AI spear phishing and its SMS-based cousin, smishing.

How AI vishing attacks work in 7 steps

AI vishing attacks follow a predictable seven-step process, starting by gathering intelligence on a target, then laundering stolen funds from them.

Understanding each step is essential for your protection. It is not enough to simply hope employees "spot the fake call". You need to be savvy to the methods adopted by threat actors, and proactively guard against them.

Step 1: Reconnaissance

Attackers scrape LinkedIn, conference talks, breach data, and org charts to map out who reports to whom, who handles wire approvals, and who's the easiest target. This is the same intelligence-gathering that powers spear phishing; the difference here is the scam lands as a phone call instead of an email.

Step 2: Voice sample collection

Modern voice cloning only needs a few seconds of audio. A voicemail greeting, a clip from a conference talk, or a snippet from a company town hall posted on YouTube is enough to generate a convincing copy.

Step 3: Voice cloning

Consumer apps, API platforms, open-source models, and underground "executive voice" marketplaces can all produce a usable clone. Real-time voice conversion, where an attacker's live speech is converted into a target's voice as they talk, is now viable, not just through the use of pre-recorded audio.

Step 4: Caller ID spoofing (optional but common)

VoIP tools can display a trusted internal or vendor number on the recipient's screen, so checking caller ID is no longer a reliable filter on its own. This is the same technology that powers smishing attacks.

Step 5: Pretext and live manipulation

The call leans on urgency, authority, and isolation ("don't loop anyone else in yet", “this is too sensitive for anyone else in your team”). Common enterprise pretexts include a help-desk password reset, MFA re-enrollment, an executive wire-transfer authorization, a secret company acquisition, a vendor payment-detail change, or even an HR issue requiring discretion and confidentiality.

Step 6: Extraction

The goal here is to obtain user credentials, an MFA code, installation of a remote-access tool (Quick Assist, AnyDesk, TeamViewer), or a direct financial transfer. This is also the step where a victim can be talked into downloading malware, for example, a "help desk" caller directing them to a lookalike webpage.

Step 7: Monetization and lateral movement

If the target approves a financial transfer, stolen funds are laundered through mules or crypto mixers within hours. Stolen credentials get pivoted into SSO, CRM, and cloud environments, and can power a much larger breach.

This seven-step chain is built to beat the two defenses most companies still lean on: caller ID checks and the guidance to "only trust a familiar voice." Unfortunately, as our next five case studies show, we can no longer trust these defenses – we need something different.

5 case studies exposing the real dangers of AI vishing

Real incidents from the past two years show that no company, including ones that sell security for a living, is immune to a well-run vishing call. In these cases, attackers have either used AI to create voice models to dupe targets, or used AI to gather intelligence powering the vishing scams.

1. August 2026, the private-equity vishing wave

Google's Threat Intelligence Group reported various hacking crews (Falcon, Helix, Pink, and Redact, also operating under the "BlackFile" brand) making calls placed to employees' personal cellphones at major financial firms, posing as coworkers or IT help-desk staff to harvest credentials and MFA codes via spoofed login pages.

Reuters also identified Apollo Global Management, Bain Capital, Blackstone, Bridgewater Associates, CME Group, KKR, Moody's, and TPG among the targets, and Apollo later confirmed in an SEC-related disclosure that Social Security numbers were stolen after a social-engineering attack gave attackers access to its cloud platforms. Ransom demands ranged from $750,000 to $3 million, and one crypto wallet tied to the group had received roughly $10 million in Bitcoin by mid-2026.

2. March 2026, Aura (identity-protection company)

A single, targeted vishing call against one employee gave an attacker roughly an hour of account access. The cybercrime group ShinyHunters used that access to steal around 900,000 records from a marketing database, a particularly sharp irony, given that Aura sells identity and fraud protection for a living.

3. 2025–2026, The ShinyHunters / Scattered Spider help-desk campaign

Operating together under shared tradecraft, ShinyHunters and Scattered Spider have run one of the largest vishing-driven campaigns on record, impersonating IT help-desk staff to compromise SSO platforms like Okta and Microsoft 365. Confirmed or reported victims include Google, Cisco, Qantas (5.7 million customer records), Allianz Life (2.8 million records), Pandora, Adidas, and the Dutch telecom Odido (roughly 6 million individuals affected).

4. July 2025, Cisco's CRM breach

Cisco confirmed that a single vishing call targeting one representative led to an attacker exporting a subset of basic profile data (names, emails, phone numbers, and account metadata) from a third-party CRM system. No passwords or sensitive business data were taken, and Cisco's own products and internal systems were unaffected, but one phone call was all it took to get in.

5. Early 2025, the Italian Defense Minister deepfake

In a particularly striking example, fraudsters cloned the voice of Italy's Defense Minister, Guido Crosetto, and called some of the country's most prominent business leaders, including Giorgio Armani and Prada co-founder Patrizio Bertelli, claiming urgent funds were needed to ransom kidnapped journalists. Former Inter Milan owner Massimo Moratti transferred nearly €1 million before Italian police froze the funds in a Dutch account.

These incidents aren't outliers. Vishing has become one of the most common initial-access vectors for enterprise breaches, not a fringe consumer scam. Now, let’s look at why traditional defenses are no match for these threats.

Who gets targeted by AI vishing, and why don't traditional defenses work?

AI vishing targets whoever has access to the information hackers need. Whereas vishing scams once targeted mostly executives, these days no one is immune, and different roles have different – but equally valuable – payoffs for attackers:

• Executives (CEO/CFO): Plenty of public-facing voice samples exist, and they carry authority over funds, making them high-value targets.
• Finance and treasury teams: Trained to move fast when an executive asks for something, and typically have the ability to authorize payments (sometimes unilaterally).
• IT help desk, especially entry-level: Typically, individuals in these roles have the least amount of experience and training. As a first point of contact, this can make them valuable. Attackers tend to use entry-level targets as a stepping stone to supervisory or management staff who trust an "already-vetted" caller.
• Executive assistants: They have calendar, travel, and vendor-payment access, sitting adjacent to the C-suite without being the C-suite, which makes them a lower-profile, less-protected target.

The reason AI vishing works so consistently is that the traditional phishing defenses aren’t up to scratch:

1. Caller ID can be spoofed with off-the-shelf VoIP tools.
2. "Does the voice sound right?" is no longer a valid test. The UC Berkeley study found people correctly identified a voice as AI-generated only around 60% of the time, and could mistake a cloned voice for the real speaker in up around 80% of instances.
3. Email-phishing training doesn't transfer to phone calls. There's no header to inspect and no link to hover over, just a live human, or an AI, adapting to objections as the call happens.
4. Antivirus and EDR are irrelevant here. By the time malware appears, if it appears at all, the attacker already has legitimate account access via stolen credentials.

So, if the voice can't be trusted and the channel can't be filtered, the only defenses that hold up are reinforced behaviors: verification steps that happen outside the call itself, built through dedicated training and exposure to realistic simulated attacks.

Speaking of which, have you read our free list of 5 things all great phishing simulations get right?

How to spot an AI vishing call

The clearest sign of an AI vishing call isn't a technical glitch; it's a request that tries to bypass your normal process while keeping you from checking with anyone else.

Watch for these five key signs during a suspicious call:

1. Urgency paired with isolation: The caller wants something done fast and wants you to keep it quiet; "don't loop anyone else in yet" is a red flag on its own.
2. Requests to bypass usual processes: Any ask to skip a verification step, approve a payment outside the normal channel, or install remote-access software mid-call.
3. A slight lag or odd cadence in the voice: Subtle latency or unnatural pacing reveals itself under close attention, even if the identity match sounds convincing at first.
4. Incomplete knowledge of specifics: The caller may know your name, title, and a recent project, but stumble on details only a real colleague would know. This often points to partial information scraped online rather than firsthand knowledge.
5. Inability to answer a shared-context question: With a colleague, ask something a script couldn't predict, where you last grabbed lunch together, or what you talked about in your last 1:1.

If any of these show up, hang up and call the person back using a number from your own directory, never a number the caller gives you. If they pressure you to stay on the line instead, that in itself is the strongest signal you're dealing with a scam.

What to do in the first hour after a suspected AI vishing call

If you, or any member of your team thinks you’ve been the victim of AI vishing, your response should be immediate and process-driven. How you respond in the first sixty minutes determines whether a vishing call stays a near-miss or becomes a breach.

Here’s what to do if you suspect you're being targeted by an AI vishing call:

1. End the call and don't call back the same number. Don't re-engage with the caller, even to test them further.
2. Report it to IT security right away, through whatever channel your organization has designated; don't wait to see if anything actually happens.
3. Immediately change any credentials shared or entered, and revoke any active sessions or newly registered MFA devices tied to the account in question.
4. If a remote-access tool (Quick Assist, AnyDesk, TeamViewer) was installed or a payment was authorized, isolate the affected machine and freeze the transaction if possible. Contact your bank or payment processor immediately for more help.
5. Preserve details while they're fresh, the number that called, any names or department mentioned, and roughly what was asked for. This helps security and, if needed, law enforcement trace the campaign.
6. Notify anyone else who might be targeted next. Attackers who reach one employee often work through an org chart, so a quick internal alert can stop the next call from landing.

The AI vishing defense playbook: building realistic simulations in 8 steps

To build a defense, you need to start out by finding out how your team actually performs today, then create simulations that feel like the real thing instead of a test people can memorize. From there, targeted coaching, regular scenario rotation, hardened process controls, and a reduced digital footprint close the gaps that training alone can't.

Here is our 8-step playbook to train your team to stay safe:

Step 1: Baseline before you train

Run an unannounced, realistic vishing simulation before any training rollout so you have a true failure rate to work from, rather than guessing and failing.

Step 2: Build attacker-grade pretexts, not generic scripts

Your simulated pretexts need to be as specific as what real attackers use: IT help-desk password/MFA resets, executive wire-transfer authorization (the classic CEO/CFO fraud pattern), vendor payment-detail changes, and callback/TOAD hybrids where an "invoice" email drives the target to call a number staffed by a live AI agent. Tailor these to different industries and team functions rather than running one script for the whole company.

Step 3: Make the simulation adaptive, not a recording

Static, pre-recorded prompts train employees to fail a fake test rather than a real one. Sophisticated campaigns like the ShinyHunters/Scattered Spider operations adapt in real time to hesitation, objections, and questions, so your simulation should use a live conversational AI agent that can improvise rebuttals rather than a fixed script tree.

Step 4: Combine channels just like real callback scams

Pair a simulated phishing email or text with a simulated follow-up call, or the reverse. Measure whether employees who'd resist a phone call alone still fall for it once an email has "pre-verified" the pretext.

Step 5: Close the loop with targeted coaching, not blanket training

Repeat-fail employees and high-privilege roles (finance, help desk, executive assistants) need individualized follow-up to reinforce specific lessons and build safer habits, rather than generic, company-wide refresher training.

Step 6: Rotate scenarios and re-test on a cadence

Attackers don't reuse the same pretext twice, and neither should your simulation program. Frequent re-testing with new pretexts prevents "pattern memorization," where employees learn to spot a specific test rather than develop the underlying safe behavior.

Step 7: Use training to reinforce process controls

Simulation without a structural fix just proves the vulnerability exists; it doesn't close it. Pair the training with:

• Callback verification using numbers from a pre-registered directory, never a number the caller provides.
• Two-person approval for wire transfers and MFA/credential resets.
• Phishing-resistant MFA, since push-based MFA can be talked through by a vishing caller in real time.

Step 8: Proactively limit what attackers can work with

An attack surface and digital footprint that's harder to scrape makes every step in the seven-step attack chain harder to execute in the first place. Helping employees understand and manage what they expose publicly (old conference talks, voicemail greetings, oversharing on LinkedIn) denies attackers the raw material they need to build a convincing pretext.

This combination of realistic vishing simulation and process controls is exactly what Riot Security offers to help prepare your team. If you're building out a broader security-awareness program, our guide to phishing training for employees covers how to structure it end to end. To see how vishing simulation specifically works, talk to one of our experts.

AI vishing is a huge threat, but the right simulation platform can help keep your team secure

AI vishing is one of the fastest-growing threats in enterprise security, and as voice models keep improving, the "does it sound right?" test is only going to get less reliable. Caller ID, familiar-voice trust, and email-based training all fall short against a channel that leaves no digital artifact to inspect, just a phone call and whatever the person on the other end decides to do.

Building the right habits takes exposure to the real thing. To find out how Riot can help you launch AI vishing simulations every bit as sneaky as the real thing, talk to one of our experts today.

FAQ

1. What is AI vishing? AI vishing is a phone-based social-engineering attack where criminals use AI-cloned or AI-generated voices, and sometimes live conversational AI, to impersonate a trusted person and manipulate a victim into sharing credentials, MFA codes, sensitive data, or transferring money.
2. How is AI vishing different from regular vishing? Traditional vishing relies on a human scammer and a generic script. AI vishing adds a cloned or synthetic voice and, increasingly, a live AI agent that can adapt its responses to the target's questions and objections in real time.
3. How much audio does it take to clone a voice? Modern voice-cloning tools can produce a usable clone from just a few seconds of audio; a voicemail greeting or a short clip from a public talk is often enough.
4. Can voice authentication stop AI vishing on its own? No. Voice-based identity checks are themselves vulnerable to cloning, and the UC Berkeley research above shows human listeners struggle to catch a clone by ear alone. Voice recognition needs to be paired with process controls like callback verification and two-person approval.
5. What industries are most targeted by AI vishing? Financial services and private equity have been especially targeted in 2026, but help-desk-style vishing has hit technology, telecom, airline, insurance, and retail companies too, anywhere an attacker can reach an employee with SSO or CRM access.
6. How can I spot an AI vishing call? Watch for urgency paired with a request for secrecy, pressure to bypass your normal verification process, and an inability to answer a shared-context question a real colleague would know. If in doubt, hang up and call back on a known number.
7. What's the first thing to do if an employee falls for an AI vishing call? End the call, change any shared credentials immediately, revoke active sessions or newly added MFA devices, and report it to IT security right away rather than waiting to see if anything happens.
8. How can I choose the right vishing simulation platform? Look for adaptive, live-agent simulations rather than static recordings, multi-channel scenarios that combine email and calls, industry- and role-specific pretexts, and a program built to rotate scenarios so employees build real judgment rather than memorizing one test.