From Phishing to Vishing

Two noteworthy types of phishing attacks have recently been reported. The first involves the International Monetary Fund. A July 14 IMF press release warns the public about both phishing and website spoofing attacks using the IMF's name, and indicates that some of the fraudulent solicitations offer that hardy perennial of investment fraud schemes, the "high-yield" or "prime bank" scheme.
The second, reported in a July 11 Internet News article and a July 15 E-Commerce Times article, involves VoIP-based spam/phishing attacks, in which the spam purport to be from a financial institution. In this attack, which the Internet News article labels "vishing," The spam text is intended to persuade recipients to dial a telephone number and enter their bank account and PIN numbers. The E-Commerce Times article cites a senior research scientist with Cloudmark, Adam J. O'Donnell, in explaining that callers are "connected over VoIP to a PBX -- private branch exchange -- running an IVR [i.e., Interactive Voice Response] system that sounds exactly like their own bank's phone tree, directing them to specific extensions." The article adds that "VoIP-based services allow phishers to cheaply add and cancel phone numbers that are harder to trace than conventional numbers."