E-mail is the preferred method used by hi-tech criminals when delivering spam, as well as viruses and phishing messages – in which an e-mail and/or website purports to be that of a bank or financial institution.
Some criminals are now using net phone systems in a bid to make their invites look more legitimate and convince people to hand over useful details such as credit card numbers, bank account details or personal information.
The scam has been dubbed “Vishing”.
Vishing as defined by Wikipedia is the criminal practice of using social engineering over the telephone system, most often using features facilitated by Voice over IP (VoIP), to gain access to private personal and financial information from the public for the purpose of financial reward. The term is a combination of “voice” and phishing. Vishing exploits the public’s trust in landline telephone services, which have traditionally terminated in physical locations known to the telephone company, and associated with a bill-payer. The victim is often unaware that VoIP makes formerly difficult-to-abuse tools/features of caller ID spoofing, complex automated systems (IVR), low cost, and anonymity for the bill-payer widely available. Vishing is typically used to steal credit card numbers or other information used in identity theft schemes from individuals.
Vishing is very hard for legal authorities to monitor or trace. To protect themselves, consumers are advised to be highly suspicious when receiving messages directing them to call and provide credit card or bank numbers. When in doubt, calling a company’s telephone number listed on billing statements or other official sources is recommended instead of calling numbers from messages of dubious authenticity.
The criminal either configures a war dialler to call phone numbers in a given region or accesses a legitimate voice messaging company with a list of phone numbers stolen from a financial institution.
Typically, when the victim answers the call, an automated recording, often generated with a text to speech synthesizer, is played to alert the consumer that their credit card has had fraudulent activity or that their bank account has had unusual activity. The message instructs the consumer to call the following phone number immediately. The same phone number is often shown in the spoofed caller ID and given the same name as the financial company they are pretending to represent.
When the victim calls the number, it is answered by automated instructions to enter their credit card number or bank account number on the key pad.
Once the consumer enters their credit card number or bank account number, the visher has the information necessary to make fraudulent use of the card or to access the account. The call is often used to harvest additional details such as security PIN, expiration date, date of birth, etc.
Vishers generally prefer to use automated responders and war diallers. There have been reported instances where human operators have played an active role in trying to convince the victims to part with important personal information. Data collected from a study done in the United States in 2009 by Federico Maggi found that the most recurrent words used in automated, recorded scams are different from those leveraged by human scanners.
For example, automated voices frequently contain words such as “press” (a button) or “number”, while humans typically resort to more complex social engineering techniques.
In a common variation, an email “phish” is sent instead of war-dialling – the victim is instructed to call the following phone number immediately, and credit card or bank account information is gathered.