Introduction
Many organizations treat vishing attacks as a telephony problem: block more spoofed calls, train more people to hang up. Those measures help, but in account takeover cases the call is usually only the first half of the attack. The second half happens on a fake site, where the customer enters the credentials and one-time passcodes the attacker needs.
This article follows a vishing attack from the call to the fake site, looks at what call authentication, awareness training and takedown each contribute, and explains why visibility into the fake site gives fraud teams an earlier point to act.
Why Vishing Attacks Keep Growing
CrowdStrike’s 2025 Global Threat Report recorded a 442% increase in voice phishing between the first and second halves of 2024. Mandiant’s M-Trends 2026 ranked voice phishing as the second most common initial infection vector in the incidents it investigated.
The financial stakes are rising with it. Deloitte’s Center for Financial Services projects that generative AI could enable fraud losses of $40 billion in the United States by 2027, up from $12.3 billion in 2023, with voice cloning among the techniques driving that growth.
The industry response has focused mainly on the call: wider STIR/SHAKEN adoption, better call filtering and awareness campaigns that tell customers to hang up and call back. These controls reduce the number of attacks that reach customers. They do less for customers who answer, believe the caller and follow the instructions, because in many cases those instructions lead to a website.
How a Telephone-Oriented Attack Unfolds
Telephone-oriented attack delivery (TOAD) describes vishing attacks in which the call directs the victim to take an action online. A typical sequence has six steps.
Steps 1 to 3: Before the call connects
- Reconnaissance. Attackers collect names, account types and other details from public profiles and breached data so the call sounds informed.
- Pretext. They choose a scenario that encourages fast action, such as a fraud alert, an account suspension or a security check.
- Caller ID spoofing. They display the organization’s real number. STIR/SHAKEN authenticates calls on IP networks, but the FCC noted in April 2025 that authentication is lost when any part of the call path uses non-IP technology, and proposed rules to close that gap.
An impersonated organization has limited influence over these steps. Its customer data may already be in breached datasets, and its phone number and branding are public.
Steps 4 to 6: From the call to the account
- The call. The attacker builds urgency and gives the victim a web address to verify their identity. AI voice cloning can make the caller sound like a real agent.
- The fake site. The victim visits a copy of the organization’s login page and enters credentials, passcodes or payment details while the attacker stays on the line.
- Account takeover. The attacker uses the details, sometimes within minutes, to access the real account and move funds.
Step 5 is where the attacker’s infrastructure and the victim meet. It is also the step that most security stacks see least clearly.
The Speed of the Fake-Site Step
The Verizon 2024 Data Breach Investigations Report found that the median user clicks a phishing link 21 seconds after opening the email and enters their data 28 seconds later. In a vishing attack, the caller is often guiding the victim through each step in real time.
Takedown runs on a different timescale. Research presented at The Web Conference 2025 measured how long phishing sites stay live after detection and found a median of 5.46 hours and an average of 54 hours. A fake site can collect credentials from many customers during that time.
The interval between a customer reaching the fake site and the organization knowing that customer is at risk is the window of exposure. In vishing attacks it can be short for the attacker and long for the defender.
What Each Existing Control Contributes
Each of the common responses to vishing addresses a real part of the problem. The question is what each one can see.
Call authentication
STIR/SHAKEN confirms that a call came through a verified carrier path. It reduces spoofed robocalls and makes some impersonation harder. It authenticates the origin of a call, not the intent of the caller, and the TNS 2026 Robocall Investigation Report found that as much as 20% of signed traffic in some networks showed over-attestation. Once the call ends, call authentication has no view of the website the victim visits next.
Security awareness training
Training teaches people to slow down and verify unusual requests, and it remains worthwhile. It is harder to apply under pressure, on a live call, with a caller who knows personal details and sounds like the real organization. Researchers at Queen Mary University of London found in 2025 that listeners struggled to tell AI voice clones from real human voices. Training reduces risk, and it works best alongside controls that do not depend on the customer spotting the deception.
Digital risk protection and takedown
Digital risk protection services find impersonating domains and fake sites and work to have them removed. That reduces how long a fake site can operate. These services usually see the site itself rather than the customers using it, so they may not show which customers visited, which entered credentials or which accounts now need attention.
Fraud detection and authentication
Fraud detection, behavioral analytics and authentication controls assess risk when the attacker tries to use the stolen details on the real site. They are well placed to stop suspicious logins and transactions. Their decisions improve when they know that a customer exposed credentials on a fake site shortly before the login.
The Gap Between These Controls
Put together, these controls cover the call, the fake asset and the login. The part with the least coverage is the customer’s activity on the fake site: who visited it, what they entered and which accounts that puts at risk.
That gap matters because it is where the attacker obtains what they need, and because it comes before the login, where existing fraud and authentication controls make their decisions.
Visibility at the Fake-Site Stage
Closing that gap means detecting impersonation while it is happening, from the point of view of the organization being impersonated.
Memcyco’s preemptive account takeover protection platform, built on Proof of Source Authenticity (PoSA), is designed for this stage of the attack. When a customer reaches a site impersonating the brand, Memcyco can detect the visit in real time and, depending on configuration:
- warn the customer that the site is not genuine
- replace credentials submitted on the fake site with marked decoy data, so the attacker receives unusable details
- identify the exposed customer and the attacker’s device
- send user and device risk scores to fraud and authentication systems through its Risk API
What this changes for fraud teams
When decoy data is in place and the attacker later tries to use it, the attempt identifies the attacker’s device and activity rather than exposing a real customer. Fraud teams can see which customers were exposed before those accounts are misused, and authentication systems can apply stronger checks to the logins that carry that risk.
This works alongside existing controls rather than replacing them. Call authentication still reduces how many calls get through, takedown still removes fake sites, and fraud detection still decides at login. Earlier context from the fake-site stage helps each of them act sooner.
What Fraud and Risk Teams Can Ask Now
These five questions help test how much visibility a stack has into the fake-site stage of vishing attacks:
- Can we see when customers reach a site impersonating our brand? If the first sign is a customer complaint or a takedown report, the window of exposure is already open.
- Do we know which accounts were exposed before those customers next log in? This determines whether teams can reset credentials or add verification in time.
- Does our fraud scoring use signals from outside the authenticated session? Exposure on a fake site is useful context for the next login decision.
- How long does it take us to detect a fake login page today? Knowing the current number gives a baseline to improve on.
- If a campaign sent hundreds of customers to a fake site in an afternoon, how many could we identify the same day? The answer shows how wide the window of exposure is in practice.
To see how Memcyco handles the fake-site stage of a vishing attack, explore the platform.
Conclusion
Vishing attacks start with a call, but in account takeover cases they are usually completed on a fake site. Call authentication, awareness training, takedown and fraud detection each reduce risk at a different point in the attack. The stage with the least visibility is the time a customer spends on the fake site, and that is where earlier detection, customer warnings and exposed-account data can give the rest of the stack the context it needs to act before funds move.
Frequently asked questions
What is the difference between vishing and a TOAD attack?
Vishing (voice phishing) is any fraud that uses phone calls to manipulate victims. A telephone-oriented attack delivery (TOAD) attack is a form of vishing in which the call directs the victim to take an action online, often visiting a fake login page where credentials are captured.
Why doesn’t STIR/SHAKEN stop vishing attacks?
STIR/SHAKEN authenticates the origin of a call to reduce caller ID spoofing. It does not judge the caller’s intent, its coverage is limited on non-IP networks, and it has no view of the website a victim visits after the call.
How fast do victims enter credentials on phishing sites?
The Verizon 2024 Data Breach Investigations Report found that the median user clicks a phishing link 21 seconds after opening the email and enters their data 28 seconds later. In a vishing attack the caller often guides the victim in real time.
What is a fake banking portal?
A fake banking portal is a copy of a bank’s login page, hosted on a lookalike domain, built to capture credentials, one-time passcodes and account details from customers directed there by calls, texts or emails.
How does fake-site detection differ from takedown?
Takedown removes a fake site after it has been found. Fake-site detection focuses on the customers using it, identifying when a customer reaches the site so that teams can warn the customer, protect submitted credentials where configured and flag the exposed account to fraud systems.
Why does the window of exposure matter in vishing attacks?
The window of exposure is the time between a customer reaching a fake site and the organization knowing that customer is at risk. The shorter it is, the more chance fraud and authentication controls have to protect the account before it is misused.
Digital Impersonation Fraud Specialist
