Hackers keep pace with the technology and invent many methods to tricks people for stealing sensitive information and money. Vishing is one of the social engineering acts which is done by using mobile calls and phishing. Due to Covid-19 situation when we are mostly relied on mobile technology for banking transaction and purchasing our daily uses stuffs online or by calling the vendors there is a chance that we are revealing our personal information to hackers also. Hackers uses some of the information collected from various sources and call victim pretending to be genuine person and in pretext of helping the victim or due to some urgency.

Contributed By:

• Apeksha Maurya, DAV Public School, Jasola Vihar, New Delhi
• Rashi Gupta, DAV Public School, Jasola Vihar, New Delhi
• Sunidhi, DAV Public School, Jasola Vihar, New Delhi

What is Vishing?

Vishing is social engineering trick in which the fraudster makes a phone call to trap the innocent users.  The word ‘vishing’ is a combination of ‘voice’ and ‘phishing.’ Phishing is the practice of using deception to obtain personal, sensitive, or confidential information of innocent people. However, instead of using email, regular phone calls, or fake websites like phishers do, Vishers use an internet telephone service (VoIP).

Using a combination of scare tactics and emotional manipulation, they try to trick people into giving up their information. These vishers even create fake Caller ID profiles which make the phone numbers seem legitimate.

Incident:

An Indian politician named Asha Chauhan (name changed) lost ₹23 lakh to vishing cyber fraud. A fraudster, posing as a bank manager, duped Asha Chauhan through a mobile phone call.The fraudster called Asha Chauhan and asked for her bank details on the pretext of wanting to donate some money to her party fund due to her good work for the community. Asha Chauhan did not realize that it is a Vishing attack and shared her bank account number. Fraudster managed to convince her to install an App from the given link to fill bank account details. The moment she did that the fraudster had full control on her smartphone. Soon, Ms. Chauhan got an SMS that ₹23 lakh was debited from her account.

Modus Operandi

The modus Operandi of the cyber criminal to trick the people to reveal sensitive information to steal money or force the victim to transfer some money unsolicited account. Fraudster calls the victim and presents a situation which seems genuine and if not followed the caller’s instruction victim may get caught by police or loose money or someone loose his/her life.

How does Vishing work?

Almost all vishing attacks have a few things in common. The phone calls are initially placed from spoofed phone number. Fraudster either calls the victim directly or uses voice simulator to change the voice. In some cases attacker use a recorded message to make such calls genuine. If you don't pick the phone, they may leave a voice message and request or give a warning that if you don't call back you will be trouble.

Types of Vishing:

• Banking Vishing: Attacker have some information about the victim, which he may have harvested from various source and knows that the victim needs some banking help or calling victim on behalf of bank due to some problem with victim’s bank account. Attacker may ask victim to transfer the money to an account if not done victim will lose all money.
• Donation call: Fraudster calls the victim pretending to a representative from some charitable organization, insurance company, mega lottery company or a person who does not have any relative and have lots of money and he wants to donate. Attacker convince the victim to reveal bank accounts and personal details so he can transfer the money but in result victim loses the money.
• Involved in car accident: Fraudster pretends to be from a car accident insurance company and help you get good amount from insurance company if you consent that you have been involved in a car accident.
• Tax fraud: Attacker threatens the victim that some irregulaties have been found in tax filling and income tax department is going to file a complain against the victim. The caller convinces the victim that if he pays some amount to caller the victim can be saved and this can be settled with income tax department without any problem.
• Accident Call:  In this vishing attack, the fraudster exploits the emotions for money. Caller can inform - “Your Relative is in emergency state and is admitted in a hospital. You need to give money for the hospital fees.”  The visher hopes you’ll hear the message and panic. And then transfer some money.

Protection mantra

• Be aware – Knowing how these thieves operate can help you from getting scammed. Always remember that legitimate a business doesn’t make unsolicited requests for personal, sensitive, or financial information. Anyone who does this over the phone is probably trying to scam you.
• Don’t give in to pressure – If someone tries to coerce you into giving them sensitive information, hang up.
• Don’t answer phone calls from unknown numbers.
• Stay calm and don’t panic – Since these criminals frequently play on your emotions, keep a cool head and hang up the phone. If you still feel afraid, wait 10 minutes and then call your bank, credit card company, or whoever the caller claimed to be. Then verify whether there is a real problem.
• Be skeptical at all times – Even if your Caller ID gives the name of a bank, charity, or some other company or organization, it could be a trick.

Weseso is a non-profit organization which works for cyber safety of the society with students as agents of change.

To learn more about cyber security read weseso blogs, written by students from different schools. You can also write blogs and take part in various knowledge sharing discussion. To get involved, you first need to become a cyber warrior and become a part of larger community who are committed to secure family, friends and society from cyber crime.
To know how to become a cyber warrior, click the link: https://weseso.org/how-to-become-a-cyber-warrior/