Verify unusual phone requests (vishing)

Voice phishing ("vishing") is [[phishing]] with a human voice and a

spoofed caller ID — and it works because phone calls feel more real

than email. The costumes vary; the con doesn't.

The common costumes

• "IT support" calling about a problem they need you to fix

together — asking you to read a code, approve a prompt, install

a remote-access tool, or share a password.

• "Your bank's fraud team" needing to "verify" account details

or move money to a "safe account" (banks never do this).

• "A vendor" updating payment details by phone (the voice

version of KB-0134 — same verification law applies).

• "Microsoft/your provider" about a virus they've detected.

Caller ID showing a real name or number proves nothing — spoofing

it is trivial.

The one habit

Legitimacy survives a callback. Say: "I'll call you back

through the main number," hang up, and dial the number *you

already have* — from your records, the back of your card, the

official website you typed yourself. A real caller respects this

every time; resistance to it ("this line only", "no time") is

itself the diagnosis.

Three hard lines while on any inbound call:

1. Never read out a code that was texted or shown to you — those

codes approve sign-ins (KB-0007's rule by voice).

1. Never install software or grant remote access at an inbound

caller's request.

1. Never share a password — no legitimate support asks (KB-0008

says the same about tickets).

Worth knowing about real IT support

Genuine support that needs you expects verification and often

initiates it — being asked to prove identity, or offered a way to

verify them, is the system working. Anyone offended by

verification is flying a flag.

If a call got further than you'd like

Same speed rule as every scam: report it immediately (KB-0030's

logic) — what was shared, what was installed, when. Fast honesty

shrinks these to non-events; the caller is counting on

embarrassment buying them time.