Vishing: The Phone Scam Draining Bank Accounts in Colombia

A call that shows your bank's real number on the screen, a calm voice that confirms "just" your full name and the last digits of your ID, and an urgent explanation about "suspicious activity" that needs verifying right now. By the time the victim realizes something was wrong, they've already handed over the information the attacker needed to access their account. Vishing — voice phishing — combines the classic psychological manipulation of phone fraud with technical tools that make the call seem completely legitimate, even to someone cautious.

The technique that makes vishing particularly dangerous is caller ID spoofing. Tools exist — some originally intended for legitimate use, misappropriated for fraud — that let an attacker make the victim's phone screen display the real number of a known bank or institution, even though the call originates from somewhere completely different. This eliminates one of the most intuitive checks people tend to rely on: "the number matches, so it must be real."

While specific variants change, the psychological pattern behind most vishing calls follows a recognizable structure:

First, establish quick credibility — mentioning partial real data about the victim (obtained from previous data breaches, social media, or public information) to create the sense that whoever is calling genuinely has legitimate access to the account.

Then, create specific urgency — a suspicious transaction that needs to be "blocked" immediately, or an opportunity expiring in minutes.

Finally, ask for what they actually need — often framed as a "security verification," never as what it really is: directly handing over the credentials that enable the fraud.

Vishing aimed at businesses often targets help desks or technical support staff, with the attacker posing as an employee who "forgot their password" and needs an urgent reset, or as an external IT vendor requesting remote access to fix a made-up technical issue. This vector connects directly to what we explore in our guide on spear phishing — prior research on the organization makes the call far more convincing.

Pressure to act immediately, without hanging up to verify. Any legitimate call from a bank or serious institution has no problem with someone hanging up and calling back the known official number. Resistance to this is a strong signal.

Requests for information the institution should already have. A real bank doesn't need you to confirm your full password or dynamic PIN over the phone — it already has that information, or has ways to verify your identity that don't depend on you repeating it back.

Caller ID alone isn't sufficient verification. Since it can be spoofed, seeing the "correct" number on screen shouldn't, by itself, generate enough trust to share sensitive information.