Caller-ID spoofing and vishing: a defensive guide

What caller-ID spoofing and vishing are

Caller-ID spoofing is the manipulation of the number a call appears to come from, so a call looks like it originates from a trusted or local number when it does not. Vishing, or voice phishing, is the use of a phone call to trick someone into revealing information, making a payment, or granting access. Spoofing makes vishing more convincing, because the displayed number lends false credibility.

The two combine into a business risk: a caller who appears to be your bank, your own IT department, or a supplier is far more likely to be trusted by staff, and a phone system that can be abused to place calls adds a second problem on top of the social one.

Why it matters for organisations

Telephony is often the weakest link in an otherwise well-defended organisation. Email security has matured, but the phone is still widely trusted, and the caller-ID display is treated as identity even though it is not designed to be.

• Staff can be manipulated into transferring money, resetting credentials or disclosing information over a call that appears legitimate.
• A compromised or permissive phone system can itself be used to place large volumes of calls, adding toll-fraud loss to the social-engineering risk.
• Attacks that begin on the phone often bypass the technical controls that protect email and web channels.

Defensive controls that reduce the risk

No single control removes the risk, so defence is layered across people, process and the phone system itself.

• Treat the caller-ID display as a claim, not proof of identity, and train staff to verify sensitive requests through an independent channel.
• Establish call-back procedures for payment changes, credential resets and access requests, using known numbers rather than numbers offered by the caller.
• Reduce what your own phone system can be abused to do: restrict outbound and international dialling, secure administration, and monitor for anomalous calling.
• Include the phone channel in security awareness alongside email phishing, because staff are the first line of defence against vishing.

The phone-system angle

Social-engineering defence is essential, but the technical state of your own telephony matters too. A phone system with permissive dialling, weak administration or poor monitoring can be drawn into fraud, and it can be difficult to tell abuse from legitimate use without the right controls in place.

An authorised assessment checks the controls that limit how your telephony can be abused, from outbound-calling restrictions to monitoring, so the technical side of the risk is measured rather than assumed. This complements, rather than replaces, staff awareness.