Telephone scams, often referred to as vishing--a contraction of voice and phishing--are gaining steam among cyber spoofers, as witnessed by the $1.2 billion lost to the swindles last year, according to Federal Trade Commission (FTC) figures.
Overall, consumers lost $8.8 billion to fraud in 2022, the agency said. Number one on the list of fraud schemes was imposter trickery. Reported losses to business imposters was $660 million in 2022.
Losses to phone scams yielded the highest reported loss per person with a median of $1,400.
Vishers are high volume hackers that use social engineering tactics to lure victims to interact with them mostly using an email, text message, phone call, or direct-chat messages. Indeed, a recent study by endpoint security cyber defender Trellix found vishing spiked 142% from Q3 2022 to Q4 2022. Some 85% of vishing attacks were tied to free email services.
How MSSPs Can Help Defend Against Vishing
As the figures show, vishing is not confined to consumers but, in actuality, is more of a business heist, hitting unaware and under trained employees. Managed security service providers (MSSPs) versed in anti-social engineering training and education, should take note of the opportunity to provide additional value to their business customers.
The core of a vishing attack lies in preying on people’s good intentions by tricking them--often with threats--into providing confidential information such as credit card numbers and internal business data, that they wouldn’t otherwise disclose. The tricksters typically impersonate powerful government agencies such as the FTC to strong-arm their victims into talking with them or returning voicemails.
How Vishing Thwarts Phishing Defenses
Vishing emails can readily skirt traditional security defenses, like secure email gateways (SEGs), because they do not contain malicious, detectable links. These missing lures can make it easy for threat actors to impersonate trusted people within an organization, convincing untrained employees to call a unique phone number. Once called, the employee engages verbally in a convincing conversation or message and is fooled into handing over sensitive information.
While vishing may be difficult to slow down, training and education of employees can help. This is where companies such as Cofense, Imperva and others come in. Cofense, for one, has developed a managed and customizable solution that trains employees to identify and report vishing threats that bypass a company’s SEGs.
Cofense’s solution combines its simulation technology with a new voice response technology to help enterprise organizations defend against vishing threats.
“To illustrate the devastating power of this type of attack, vishing was used successfully in the recent crippling cyberattacks on the MGM casinos,” said Jason Reinard, senior vice president of product engineering at Cofense.
Last August, ransomware hijackers addled MGM’s networks and demanded an undisclosed ransom to bring their systems back online. The company subsequently said the attack would cost it some $100 million.
Imperva, a cybersecurity protector, recommends the following to slow down vishing campaigns:
