We’ve all received them: the suspicious phone call from an unknown number, the automated message claiming a problem with our bank account, or a “last chance” offer to reduce our credit card interest rate. These are often the tell-tale signs of a “vishing” (voice phishing) scam, and they are largely powered by a single, powerful technology: Voice over Internet Protocol, or VoIP.
VoIP, which allows calls to be made over the internet rather than traditional phone lines, has revolutionized communication for businesses and individuals. However, its flexibility and low cost have also made it a favorite tool for scammers, allowing them to deceive victims with alarming ease.
Here’s a look at the techniques scammers use to exploit VoIP services and what you can do to protect yourself.
The Art of Disguise: Caller ID Spoofing
The most common and effective VoIP scamming technique is caller ID “spoofing.” This is the practice of falsifying the information that appears on a recipient’s caller ID display to disguise the scammer’s true identity. Using specialized software and services, a scammer can make a call from anywhere in the world appear as if it’s coming from a local number or a trusted organization.
Scammers leverage this tactic in several ways:
- Neighbor Spoofing: This involves making the incoming call appear to be from a number with the same area code and first few digits as your own. The logic is simple: people are more likely to answer a call that looks familiar.
- Impersonating an Authority: Scammers can spoof the numbers of government agencies like the IRS or Social Security Administration, tech companies like Microsoft, or even your local police department. This creates an immediate sense of urgency and authority, making a victim more likely to comply with demands.
- Impersonating a Business: A scammer can make a call appear to be from your bank, credit card company, or a utility provider, often with a convincing-sounding name on the caller ID. They’ll claim there’s a problem with your account and ask you to “verify” personal or financial information.
The Untraceable Call and Automated Attacks
Unlike traditional landline calls, which can often be traced back to a physical location, VoIP calls are much harder to track. Scammers can route their calls through a series of servers, making them virtually untraceable. This anonymity allows them to operate with little fear of being caught.
VoIP also enables automated, large-scale attacks. Scammers can use automated dialers and pre-recorded messages to blast out millions of calls at a time. This “shotgun” approach increases their chances of finding a victim who is unaware of their scamming tactics. The calls often feature interactive voice response (IVR) systems, prompting the victim to press a number to connect with a “live representative” or to “claim their prize.”
The Vishing Playbook: How the Scam Unfolds
Once a scammer has you on the line, they use a range of social engineering techniques to get what they want. They’ll often create a sense of urgency or fear, claiming your account has been compromised, you owe back taxes, or a loved one is in trouble. They may pressure you to act immediately, demanding payment in the form of gift cards, wire transfers, or cryptocurrency—methods that are difficult to trace and reverse.
How to Protect Yourself
Fighting back against VoIP scams requires a multi-faceted approach. Here are some key steps you can take:
- Don’t Trust Caller ID: Never assume a call is legitimate just because the number looks familiar. Scammers are experts at faking this information.
- Hang Up and Verify: If a caller claims to be from a company or government agency, hang up immediately. Find the official number for that organization on a statement or their website and call them back to verify the claim. Do not use a number the caller gives you.
- Be Wary of Urgency: Scammers rely on panic. A legitimate organization will not threaten you or demand immediate payment over the phone.
- Use Call-Blocking and Labeling Apps: Many phone providers and third-party apps offer services that can filter or label calls as “spam” or “scam likely.” Take advantage of these features.
- Don’t Give Out Personal Information: Never provide sensitive information like your Social Security number, bank account details, or passwords in response to an unexpected call.