Nano-lesson · usually takes 2–3 minutes

Vishing — scam calls & fake IT support

The phone is also an attack route: fake support, fake bank calls.

Get started →

When “the bank” calls

The phone rings in the middle of your shift: “This is the bank — there's suspicious activity on your account. We need to act now.” The number on the screen looks right. It easily can: caller ID can be spoofed, and the pressure is part of the trick.

Next →

Classic calls

• “Microsoft/IT support” calls about a virus and wants you to install remote-control software (AnyDesk/TeamViewer).
• “The bank” asks you to move money to a safe account or read out a code.
• “The engineer” calls the shop or reception about the till or the printer — and just needs a code or remote access.

Next →

Does it look like the bank?

📞 Incoming call

Barclays Bank

+44 345 734 5345

“Move your money to a safe account immediately”

Both the name and the number on the screen can be spoofed — so they prove nothing. What gives it away is the request itself: your bank will never ask you to move money or read out a code. Hang up, and call back on the number on the back of your card.

Next →

Do

hang up, and call back on a number you find yourself. Never read out MFAMulti-factor authentication (MFA/2FA): an extra step beyond your password — such as a code or a tap on your phone — so a thief can't log in with the password alone./bank codes. Genuine support does not call unprompted about a virus.

Next →

Remember

💡

Hang up, and call back on a number you know — not the one they gave you.

Next →

What the research says

Scammers' strongest weapon is authority — we almost reflexively obey when “the bank” or “the boss” speaks — and scam calls are on the rise. The Arup case (around £20 million) shows that you can't judge by what you see and hear. What works: always call back on a number you've found yourself.

Lawall, SECURWARE 2025 · APWG Q4 2024 · Arup case, Fortune/CNN 2024.

Next →

Question 1 of 3

“IT support” calls: your computer has a virus, and they need to remote-control it now. The number looks like a genuine company number. What do you do?

Follow their instructions — the number looked right, after all Ask them to call back later, when you have more time Hang up — genuine support doesn't call unprompted about a virus

Question 2 of 3

“The bank” calls: fraud is happening, and you need to move your money to a “safe account” right away. What do you do?

Do as they say — they knew your name and which bank you use, after all Ask them to email the details, so you have it in writing Hang up and call the bank yourself on the number on the back of your card

Question 3 of 3

The screen shows “Barclays” and the bank's real number when the phone rings. Does that prove it's the bank?

No — the name and number on the screen can be spoofed Yes — caller ID can be trusted Yes, if they also know your name and account number

Well done!

You've completed one of the foundation courses — the ones everyone gets for free.

With a free login:

• Your points, progress and course certificate are saved.
• You get courses tailored to your role — not just the foundation courses.
• We send training exactly when you need it — for example, as a follow-up to a phishing test.

Create a free login → ← See the other courses