Which term describes a human-based attack where the attacker extracts information while speaking over the phone or leveraging IP-based voice messaging services (VoIP)?

Which term describes a human-based attack where the attacker extracts information while speaking over the phone or leveraging IP-based voice messaging services (VoIP)?

• A. Phishing
• B. Vishing
• C. SMiShing
• D. Watering hole attack

Answer: (B)

Vishing is a form of social engineering that uses voice communication to coax people into revealing confidential information or performing actions. The attacker may call or use VoIP and pose as a bank, IT support, or a colleague, weaving a believable story and sometimes creating a sense of urgency to extract data such as passwords, PINs, or account numbers. The human interaction on the phone is the key element, relying on trust and manipulation rather than digital messages alone. This is different from phishing, which typically targets you via email or other non-voice channels; SMiShing targets you with text messages; and watering hole attacks involve compromising a website you visit to steal data or deliver malware, not directly asking you for information over a call. Safeguards include verifying identities through independently verified contact channels, avoiding sharing sensitive data on unsolicited calls, and training to recognize social-engineering cues.

Vishing is a form of social engineering that uses voice communication to coax people into revealing confidential information or performing actions. The attacker may call or use VoIP and pose as a bank, IT support, or a colleague, weaving a believable story and sometimes creating a sense of urgency to extract data such as passwords, PINs, or account numbers. The human interaction on the phone is the key element, relying on trust and manipulation rather than digital messages alone.

This is different from phishing, which typically targets you via email or other non-voice channels; SMiShing targets you with text messages; and watering hole attacks involve compromising a website you visit to steal data or deliver malware, not directly asking you for information over a call. Safeguards include verifying identities through independently verified contact channels, avoiding sharing sensitive data on unsolicited calls, and training to recognize social-engineering cues.