Train your teams to handle vishing calls with spoken practice

Effective security awareness training prepares teams to react to a phone call, not only to spot a booby-trapped email. Vishing, phishing by telephone, sidesteps technical tools: the attacker gets a code, an approval or a wire transfer from the victim in person. The reflex that stops it, checking through another channel, is built by practicing spoken conversations under pressure.

This guide sets out the basics of an awareness program that includes voice. It covers the habits to install, the roles to target, reporting and measurement. It also works as an entry point to the detailed articles in our series.

Why voice is the forgotten link in awareness training

Most awareness programs grew up around email: spot a suspicious link, check a sender, report a message. That learning is useful. Yet it leaves out a channel where the attacker holds every advantage.

If you want a refresher on the email side first, read what phishing is, with definitions and examples. On the phone there is no link to hover over, no header to examine and no time to think. There is a voice, an invented context and a request. The attacker can adapt to every answer. They press, get irritated, reassure, flatter.

Our article on the definition of vishing and its examples details these calls. The essential point here: vishing is a conversation, and a conversation is prepared by conversing.

What the threat figures say

In its 2025 activity report, published on March 26, 2026, the French agency Cybermalveillance.gouv.fr says it assisted more than 500,000 victims. That is 20% more than in 2024. It notes that phishing ranks first among threats, across all audiences, with a 70% rise. The press release specifies that phishing waves come by text message, email or even audio calls.

The same document records several increases that bear directly on the telephone:

• fake bank advisor fraud (a bank impersonation scam), up 159%;
• wire transfer fraud, up 170%;
• phone number spoofing, up 517%.

It also describes a stolen-data market that is now organized, with call centers of fake phone agents specialized in manipulation. Attackers have fresh data to personalize their calls. Against that industrialization, awareness limited to one annual module is no match.

What the attack on Crédit Mutuel Arkéa reminds us of

On November 4, 2026, the Crédit Mutuel Arkéa group announced it had been the victim of a cyberattack and filed a complaint the same day. According to information relayed by AFP and franceinfo, the bank describes a sophisticated attack from outside. It went through the platform of one of its service providers. The bank rules out human error. The amounts are still being assessed, and the Paris public prosecutor's office has opened an investigation.

This episode is not a case of vishing, and it should not be used as one. It reminds us of something else: awareness is only one layer of defense, alongside the security of suppliers and tools. No training replaces a solid architecture.

The bank did, however, warn its customers against phishing attempts impersonating it. It is a familiar pattern: after a widely reported event, fake advisor and fake security department scams exploit the confusion. We detail this mechanism in our article on the wave of scams that follows a cyberattack.

The five habits that save you on a suspicious call

An effective program picks a few rules and makes them automatic. Here are five habits to install.

1. Understand the attacker's levers

Urgency, authority, guilt, isolation: callers pull the same levers. Knowing them makes it possible to spot them by ear. They are described in our article on social engineering.

2. Trust neither the voice nor the number displayed

A number can be spoofed, and a voice can be imitated. Our article on AI voice cloning shows why recognizing the person is no longer enough. A word agreed in advance and the callback become safeguards.

3. Verify identity by reliable means

Asking questions whose answer is public proves nothing. You need checks the attacker cannot obtain online, detailed in the questions to verify a caller's identity.

4. Call back through an independent channel

This is the most effective habit: hang up, then call a number you know belongs to the organization, never the one the caller gave. The callback procedure breaks most vishing scenarios.

5. Know how to say no without justifying yourself

Refusing is a social skill, not a technical one. It is learned by saying it aloud. See how to hold a refusal against a caller who insists.

The roles to train first

Not every employee receives the same calls. An effective program adapts its scenarios to the most exposed roles.

• Accounting and treasury: fake wire transfer request, banking details change. See CEO fraud by phone.
• Help desk: request to reset a password or an authentication factor. See social engineering at the IT help desk.
• Customer advisors: calls from fake customers and from customers who are victims of fake advisors. See the fake bank advisor's method and vishing training in banking.
• Local governments and hospitals: switchboards, reception desks, technical departments. See awareness training in the public sector and hospitals.

This list is not exhaustive. The right starting point remains an analysis of the calls the organization actually receives. Trainers know their teams' situations better than any catalogue.

Building a program in four steps

A vishing awareness program does not need a complete overhaul. It is built step by step, starting from what exists.

1. List the real calls. Which suspicious calls have teams received? Which roles were approached? The security team, support and managers hold this material.
2. Set short rules. Three or four rules, written in simple sentences. We never give a code over the phone. We always call back through a known channel. We report every attempt.
3. Train orally. Each rule is played out in a situation, with a counterpart who insists. The learner says the sentence rather than just reading it.
4. Measure and adjust. Reports, progress from one session to the next and the new attempts encountered feed the following scenarios.

The important point is the loop: real cases feed the scenarios, and the scenarios prepare people for the next real cases.

Common mistakes in awareness programs

• Betting everything on email. The telephone and messaging apps stay outside the scope of training.
• Multiplying rules. A person under pressure applies three rules, not fifteen.
• Blaming victims. An organization that punishes gets fewer reports, and therefore more damage.
• Relying on voice recognition. It no longer proves anything, as the article on voice cloning shows.
• Measuring completion. A finished module says nothing about behavior in front of a caller.
• Training only once a year. A reflex that is not maintained fades.

Avoiding these mistakes costs little. Mostly it requires deciding that the telephone is part of the awareness scope, on a par with email.

The sentences to have teams say

A rule becomes a reflex when it has a precise spoken form. Here are sentences trainers can have people repeat, then adapt to their organization's vocabulary.

“I’ll call you back on the official number, please hold on.”

“I don’t give out any code over the phone, not even to the security department.”

“This request follows a procedure, so I’ll have it approved first.”

“I’m noting your name and department, and passing them to security.”

These sentences have three qualities. They are short, they accuse no one and they require no justification. The employee does not have to decide whether the caller is honest. They apply a rule everyone knows.

The last sentence has a particular role: it shows the caller that the exchange will be traced. A fraudster does not like being noted, while a genuine caller sees no problem with it.

Launch checklist for the awareness manager

Before launching a program, a few checks avoid unpleasant surprises.

• The three or four rules are written down, approved by management and known to managers.
• A single reporting channel exists, and everyone knows how to use it.
• The most exposed roles have been identified, with at least one scenario per role.
• Management has stated that no executive will ever ask for an operation outside procedure.
• The tracking indicators are chosen before launch: reports, quality of reports, progress.
• A lessons-learned review is planned after each real attempt that is reported.

This list fits on one page. It is worth going through with management, because the authority to refuse has to come from the top to be credible.

Reporting, even after giving in

A program that teaches refusal without teaching reporting remains incomplete. Every attempt, successful or not, is information: it makes it possible to warn colleagues, block a wire transfer, spot a campaign.

For reporting to be quick, two conditions apply. The channel must be simple, a number or address known to all. And nobody should fear a reprimand, because shame delays the alert.

The quality of the report matters too: name given, number displayed, time, requests made, levers used, what was disclosed. A reusable grid appears in our article on reporting a security incident.

Why knowing is not enough to react

An online module transmits knowledge: you learn that a bank never asks for a code. But during a call, the person has to bring that knowledge to mind at the right moment, under stress, facing someone who insists. Between knowing and doing there is a gap that reading does not close.

That is the difference between knowledge and reflex. A reflex is acquired through repetition in conditions close to reality, with immediate feedback. We analyse this point in our article on the limits of cybersecurity e-learning.

Simulated phishing campaigns raise a similar problem. They measure a click, not a conversation. They have their uses. They do not prepare anyone to answer a caller who insists, as our article on the limits of phishing simulations explains.

Training through spoken practice

What builds the reflex is practice: saying the refusal sentence aloud, facing someone who comes back at you. Role-play makes this possible. A trainer can do it in pairs, but cannot replay the same scene with every learner, as often as needed.

Face Up meets this need. Trainers create their own scenarios, from their organization's real cases, with the help of a design assistant. The learner speaks, by voice or on video, with a persona played by an AI: fake advisor, fake supplier, hurried colleague. At the end, they receive a debrief. It shows the objectives met or missed, strengths, points to improve, an action plan and quotes of what they said. They can play again.

The design steps for such a scenario are described in our article on vishing simulation through role-play. For an overview of the method, see the role-plays offered to trainers.

Measuring what really counts

The completion rate shows who opened the module. The click rate measures a reaction to an email. Neither says whether a person would know how to refuse a call.

More telling indicators exist. You can track the reporting rate, and the speed and quality of reports. You can also track progress from one role-play session to the next and compliance with the callback procedure. Our article on measuring the effectiveness of awareness training details them.

The principle is to measure observable behavior, not attendance. A team that reports more attempts is making progress, even if the number of declared incidents rises at first.

Cyber awareness and mandatory training

Cybersecurity awareness often sits within a wider set of mandatory training: anti-money laundering, data protection, ethics, harassment. These courses share the same flaw: they are checked off, not practiced. Our series on mandatory compliance training through role-play applies the same logic to these subjects.

The two approaches reinforce each other. A person who has practiced verifying a caller applies the same reflex when a customer asks for information they must not give.

Frequently asked questions

Where should you start with vishing awareness?

Start with the most exposed roles: accounting, help desk and customer relations. Set a single rule: hang up and call back through an independent channel. Add a simple reporting channel. Then extend to other roles.

How often should people train?

A one-off session is forgotten. Short, spaced sessions with new scenarios maintain the reflex. The right frequency depends on the teams and the level of exposure, and is set with the trainer.

Is awareness training enough to stay protected?

No. It reduces the risk linked to calls and messages. It does not replace technical security, control of suppliers or approval procedures. It is one layer among them.

Does role-play replace e-learning?

They complement each other. E-learning conveys knowledge, role-play installs the reflex. The most effective approach combines both, keeping spoken practice for situations where you must react live.

To see how a trainer builds a vishing scenario and gets their teams practicing, book a demo.