Vishing is a portmanteau of "Voice" and "Phishing" - a fraud technique that extracts personal and financial information over the phone. It is the telephone version of web-based phishing. In Japan, "bank transfer fraud," "It's me" scams, and refund scams all qualify as vishing, and the National Police Agency classifies them as "special fraud," publishing the number of recorded cases and the amount of losses.
Typical techniques include impersonating a bank employee to say "Your account has been compromised" and extracting PINs, impersonating a tax office to claim "You have a refund" and guiding ATM operations, and impersonating police to say "Your account is being used for criminal activity" and coming to collect cash cards. Attackers are also known to add caller ID spoofing so that the number of a real institution appears as the origin of the call. Another pattern uses a robocall as the entry point: a recorded voice states the pretext, then asks the recipient to press a key to be connected to an operator.
Compared to email and website phishing, vishing is more troublesome because direct voice interaction allows criminals to adapt their tactics to the victim's reactions. The scripts used lean on creating urgency, eliciting sympathy, or invoking authority.
The cardinal rule is: when asked for personal or financial information over the phone, hang up and call back using the official contact number yourself. If you are asked for a PIN or a password by phone, the reliable line to hold is to give no answer, whoever the caller claims to be, including a bank or the police. For families with elderly members, repeatedly communicating this principle is crucial. In the 2020s, techniques that use voice cloning technology to mimic a family member's voice have also been reported, so a voice alone cannot confirm who is calling. Establishing a family code word is an effective defense against both vishing and voice clone fraud. Review specific countermeasures in bank transfer fraud prevention.