A phone call from someone claiming to be from Microsoft, your bank, or your IT provider — warning of an urgent security problem and offering to help fix it. Vishing (voice phishing) relies on urgency, authority, and helpfulness to extract credentials, install malware, or authorise fraudulent payments.
In 2023, a Christchurch property management company received a call from someone claiming to be from their internet bank's fraud team. The caller had the company director's name, business address, and partial account details — all obtained from public sources and a previous minor data breach. They warned of suspicious transactions and offered to help secure the account. Over the next 20 minutes, they obtained the director's login credentials, one-time authentication codes, and transferred $63,000 to an offshore account.
Why Phone-Based Social Engineering Works
Phone calls create psychological pressure that written communications don't. The real-time nature of a conversation doesn't allow time for reflection, googling, or verifying the caller's claims. The social norms around phone conversations make it harder to end a call abruptly than to close an email. Caller ID spoofing (displaying a false number) allows attackers to present a call as coming from a legitimate number — appearing as Microsoft, your bank, or your IT provider on the recipient's phone.
Vishing attacks typically use three psychological levers: authority (the caller claims to represent a trusted organisation), urgency (there's a problem that needs immediate action), and helpfulness (the caller is offering assistance, which lowers defensive instincts).
Common Vishing Scripts Targeting NZ Businesses
Microsoft/Windows technical support: "We've detected malware on your computer from your Microsoft account." The script leads to installing remote access software (AnyDesk, TeamViewer) and then the attacker has full control of the computer.
Bank fraud team: "We've seen suspicious activity on your account. I need to verify your identity and transfer your funds to a safe account." No bank will ever ask you to transfer funds to a "safe account."
IT provider impersonation: "I'm calling from [your actual IT provider name]. We've detected a security issue on your network and need remote access to investigate." This variant uses OSINT to identify who a business's IT provider is before calling.
The Simple Rules That Stop Vishing
Legitimate organisations — Microsoft, banks, IT providers — do not make unsolicited calls asking for credentials, remote access, or payment authorisation. If you receive such a call: don't act on it. End the call. Call the organisation back using a number from their official website or your existing contact records. Never use a number provided by the caller. Train staff that this process is not rude — it's correct procedure.
The test for any unsolicited call claiming to require urgent action: hang up, verify independently, call back on a number you found yourself. Legitimate callers will understand. Attackers won't be able to continue the script.
