Cybersecurity awareness in banking: training for vishing

Cybersecurity awareness training in banking must teach staff to hold a telephone conversation under pressure, not just to know the rules. Advisors, back office and treasury are called every day by strangers claiming to be a customer, a colleague or a supplier. Knowing that you must verify is not enough. You need to have already said “I'll call you back” out loud, facing someone who insists.

This article describes the three situations where vishing hits a bank. It offers a four-step method, phrases to rehearse and the DORA framework. It complements our guide to cybersecurity awareness and vishing training.

Why banks are a phone target

A bank brings together three things a fraudster is looking for: funds, personal data and staff used to answering requests. The telephone remains a normal channel in the job. An incoming call is therefore not suspicious in itself.

The general context is tense. According to the 2025 activity report of Cybermalveillance.gouv.fr, the French national cyber-victim assistance service, published on March 26, 2026, more than 500,000 victims were assisted, 20% more than in 2024. The report also notes a 159% rise in fake bank advisor fraud and a 170% rise in transfer fraud.

The same press release cites a 517% rise in phone number spoofing. This means that a number displayed as internal or familiar no longer proves anything.

The three vishing situations in banking

1. The fake advisor who calls the customer

In this case, it is the bank's identity that is stolen. The fraudster calls a customer posing as their advisor or as the fraud department, then asks them to approve a transaction. We detail the sequence in the article on the fake bank advisor method.

For the bank, the challenge is twofold: informing customers, and preparing advisors to receive customers who are wary or already victims. A customer who calls back in a panic expects a clear, fast answer.

2. The fake customer who calls the advisor

Here, the fraudster plays the customer. They know some public or stolen information, and ask for a change of contact details, a new means of payment or an urgent transfer. Their aim is to get identity verification bypassed.

Imagine a call where the person says: “I'm traveling, I no longer have my phone, can you send the code to another number?” The request is plausible, the tone is polite, and the pressure is gentle. That is precisely what makes it effective.

3. The fake colleague or fake supplier who calls the back office

The fraudster presents as a manager, a service provider or IT support. They target payment and treasury teams, or try to obtain access. The logic is the same as CEO fraud by phone.

Urgency is the usual lever: “The transfer has to go out before 4 pm, otherwise we lose the contract.” Against this sentence, the dual-approval procedure is the best defense, provided nobody dares to bypass it.

A four-step method for any sensitive call

A useful method has few steps, otherwise it cannot be recalled under stress. Here is a sequence that the trainer can adapt to each job.

Slow down. Acknowledge the pressure without following it: “I understand the urgency, I'll do it by the book.”
Verify. Ask for the items required by the internal procedure, without making up questions whose answer is public.
Call back through an independent channel. Use the number in the internal directory or in the customer file, never the one the caller gives.
Note and report. Write down what was asked and said, then warn security, even if nothing was given.

The call-back is detailed in the call-back procedure through an independent channel. Identity verification is covered in the questions to ask to verify a caller.

The exact phrases to know by heart

Under pressure, nobody composes an elegant answer. You fall back on a phrase you have already said. The trainer can make a short list of them, to be repeated out loud.

“For your security as much as mine, I'll call you back on the number in your file.”
“I can't approve this transaction over the phone, please use the app.”
“The procedure doesn't allow it, even for you. I can't make an exception.”
“I'll note your request and pass it on to the relevant department.”
“I never give out a code received by text, whoever is asking for it.”

These phrases have one thing in common: they do not put the caller on trial. A genuine customer almost never takes offense at a check presented as a house rule. A fraudster insists or hangs up. That reaction is information in itself.

Why e-learning is not enough for these situations

An online module explains what vishing is and recalls the guidelines. That is useful for knowing. But the real situation includes a voice, a rhythm, insistence, sometimes anger or kindness. None of this appears in a quiz.

The reflex comes from repeating an action in conditions close to reality. An advisor who has already refused ten times out loud finds it easier to say no on the day the call is real. We develop this mechanism in the article on the limits of cybersecurity e-learning.

For advisors, the difficulty is added to that of the customer relationship. They have to refuse without causing offense. The subject links to training bank advisors in customer relations.

The DORA framework: a training obligation for all staff

For financial entities, Regulation (EU) 2022/2554, known as DORA, has applied since January 17, 2025. Its Article 13(6) provides for ICT security awareness programs. It also provides for digital operational resilience training, for all staff and senior management. The French prudential supervisor, the ACPR, cites this article in the ICT annex to the internal control report.

The text requires awareness and training programs. It does not say in what form. A bank can therefore supplement an online module with spoken practice scenarios. These leave a record of what each person was able to do. We detail the obligation in the article on DORA and ICT security training, and the overview of other obligations on the page on mandatory compliance training.

Practicing through role play, scenario by scenario

Face Up lets trainers create their own role plays from their real cases. The learner speaks by voice with a persona played by an AI. It may be a fake customer in a hurry, a fake manager or a customer who gets irritated by a vigilance question. After the session, they receive a debrief with their strengths, points to improve and quotes of what they said.

The bank's trainer stays in control. They write the scenario with the real traps of their institution. They choose the levers (urgency, authority, guilt) and set the expected outcome: verify, call back, refuse, report. The learner can play again until the action becomes natural. More examples on the role play page.

Common mistakes in banking vishing training

A few mistakes come up almost every time a bank organizes this kind of awareness training. Spotting them in advance avoids starting from scratch on the second campaign.

Dealing only with the victim customer, and forgetting the targeted advisor.
Requiring verification without giving a phrase to do it politely.
Trusting the displayed calling number.
Assuming a failed call does not need to be reported.
Measuring only the module completion rate.

One last point concerns frequency. A one-off training fades quickly, whereas short, regular practice installs the action. Fifteen minutes a quarter is better than half a day a year, especially for teams who take calls every day.

Frequently asked questions

Which banking teams should be trained first?

Those who can trigger a movement of money or grant access: advisors, back office, treasury, IT support and telephone reception. Start with the roles where a single person can approve.

Should customers be trained too?

Informing customers is useful, but it is not the same exercise. Advisors above all need to know how to respond to a customer who has been alerted or already caught out, with simple words and a clear action.

How do you know if the training works?

Look at behaviors: calls called back, reports made, dual approvals respected. Our article on measuring the effectiveness of awareness training suggests concrete indicators.