Voice phishing, or “vishing”, is one of the fastest-growing tactics used by malicious actors to trick people into revealing sensitive information or downloading harmful software.

Like phishing, vishing is a social engineering attack. It targets human error or weakness and relies on people being tricked into performing a risky action, like clicking on a link or sharing passwords.

The development of powerful AI tools that can create fake and replicated voices has made vishing a particularly dangerous form of cyber attack. 

So, how common is vishing really? What are the impacts of vishing attacks? Who’s most impacted? 

This report covers new statistics and trends to shed light on the state of voice phishing in 2026. 

Editor’s Picks

Scale of Voice Phishing Attacks

70% of organizations have been victims of voice phishing (Keepnet Labs)

Vishing is one of the methods most often used by attackers to target organizations.

Generative AI fraud costs could reach $40 billion by 2027 (Deloitte)

Deloitte’s Center for Financial Services projects that fraud using generative AI (which includes vishing) could cost individuals and organizations upwards of $40 billion annually. That would represent a growth rate of over 30% per year.

Voice phishing attacks have become 442% more common (CrowdStrike)

There were 442% more voice phishing attacks in the second half of 2024 compared to the first half of the year.

Comparing the first and final months of 2024 shows an even more striking increase: In January 2024, CrowdStrike recorded just two vishing attacks. In December, they recorded 93. 

6.5% of employees have given away sensitive information to a voice phishing attack (Keepnet Labs)

This doesn’t mean 6.5% of employees targeted by vishing, but means 6.5% of all employees have been successfully tricked by a vishing attack.

77% of AI-powered voice phishing victims lost money as a result of the attack (McAfee via HR Magazine)

AI tools have made it easier for attackers to conduct sophisticated, convincing vishing attacks with a worryingly high success rate. 

10% of financial institutions have suffered deepfake voice phishing attacks costing $1M+ (Group IB)

Massive losses are rare, but even six-figure losses are somewhat common. 

2.56 billion scam calls are made to Americans every month (Public Interest Network)

This includes voice phishing calls and other scam calls, such as telemarketing and robocalls. 

But the true figure could be up to 3.1 billion scam calls every month (Truecaller)

The volume of scam phone calls sent every month is difficult to estimate precisely, but it’s certainly massive. In part, that’s because AI-powered tools make automating scam calls at scale relatively straightforward.

68% of Americans receive a scam phone call at least once a week (Pew Research)

Almost everyone in the US with a phone has received a scam phone call at least once. Over two-thirds receive at least one weekly.

And 31% receive scam phone calls at least daily (Pew Research)

Spare a thought for the 21% of Americans who say they receive scam phone calls several times per day. 

Impacts of Voice Phishing Statistics

Voice phishing attacks have an average annual cost of $14 million per organization (Keepnet Statistics)

That’s a significant increase from 2022, when IBM calculated the average loss at $10.1 million. The average is likely driven up by particularly lucrative attacks; for example, in 2024, one CEO was tricked by an AI-generated video call into authorizing a transfer of $25 million.

Korea suffered $260 million in losses to voice phishing in 5 months (SeoulEconomicDaily)

That’s over 350 billion Korean won, around the same as the total losses in 2023.

The average voice phishing attack costs financial institutions $600,000 (Group IB)

According to Regula Forensics, financial services lose more money, on average, to deepfake-related attacks than other industries. For example, the average loss in Telecommunications is $480,769, while that in Aviation is $354,616. 

Less than 5% of funds lost to voice phishing scams are recovered (Group IB)

Scammers can quickly launder stolen funds through crypto mixers, in which crypto from many different users is combined to hide where the money is coming from and going. They may also use money-mule chains, which are networks of bank accounts used by individuals to hide the origin and ownership of illicit funds and to distribute them to recipients.

The average cost of recovery from a major voice phishing incident is $1.5 million (Right Hand AI)

Recovering from a vishing attack can place a significant financial burden on an affected organization.

The median loss per voice phishing victim is $1,400 (Right Hand AI)

It’s possible the median loss is lower than the average loss because a smaller number of victims lose a lot, while most lose relatively little. 

Trends in Voice Phishing

Voice phishing (and other phishing) attacks have increased by 1,265% since the launch of ChatGPT (Enea)

AI tools have made all kinds of phishing attacks, including vishing, much easier to conduct at scale.

6% fewer phone companies have completely installed mandatory anti-robocall software compared to 2024 (PIRG)

Phone companies that operate in the US legally must install anti-robocall software to authenticate caller IDs, even if they aren’t based in the US. This software can help protect people against malicious calls, including attempted voice phishing attacks. The number of phone companies that have fully implemented this required software declined by 281 between 2024 and 2025.

The money lost to scams that started with a phone call increased by 16% in 2025 (FCC via PIRG)

Perhaps due to AI technology, vishing is becoming an increasingly lucrative tactic.

Voice scam calls have become 19.6% more common (Public Interest Network)

In 2024, 2.14 billion scam calls were made to Americans every month. That figure increased to 2.56 billion in 2025. 

A different estimate, from Truecaller, has scam calls becoming 14.8% more common. According to Truecaller, in 2024, there were 2.7 billion scam calls made to Americans every month, which increased to 3.1 billion per month in 2025.

Phone scam reports to the FTC have increased by 9% (FTC via Public Interest Network)

This compares the first half of 2025 with the first half of 2024. It includes voice phishing attacks and other phone-based scams.

There were 1.5% more robocalls made in the US in July 2026 compared to the month before (TransNexus)

According to APWG, vishing attacks (and other similar attacks) become less common during the holiday season.

Who’s Most At Risk Of Voice Phishing?

20% of voice phishing victims in 2023 were aged 60 or older (GSMA)

According to the Administration for Community Living, 78.9 million Americans are aged 60 or older. That’s roughly 23% of the US population.

Young adults are three times more likely to have lost money to a phone scam than older adults (Business Wire)

You might expect older people to be more vulnerable to phone scams, but one study suggests otherwise. According to this research, one-third of adults aged 18–44 have lost money to a phone scam, while just 11% of adults aged 45 or older have done so.

This is backed by other research. For example, a study from Deloitte found that Zoomers (12-29 years old) are over three times as likely to fall for online scams compared to Baby Boomers. In part, that’s because younger adults are more used to sending money or sharing information online (and over the phone), potentially making them more vulnerable to scams.

19.2% of manufacturing and engineering professionals have received voice phishing attacks (Cyber Defense Magazine)

That made manufacturing and engineering the industry most targeted by vishing attacks. It is followed by entertainment and media, in which 18.1% of professionals have been targeted.

On the other hand, just 3.8% of technology and IT professionals have been targeted by vishing scams, making it the least-targeted industry. Another infrequently targeted industry is the government and the public sector, in which just 4.7% of professionals have been targeted by a vishing attack.

11.5% of customer support professionals have been victims of a voice phishing attack (Cyber Defense Magazine)

That makes customer support the role most commonly targeted by vishing attacks.

Men are 32.6% more likely to lose money to phone scams than women (Business Wire)

One-quarter of men in this study have lost money to a phone scam, compared to 18% of women.

Hispanic Americans are twice as likely to have lost money to phone scams compared to White Americans (Business Wire)

Certain demographics are more vulnerable to phone scams. 39% of Black Americans and 30% of Hispanic Americans have lost money to phone scams, compared to 15% of White Americans.

This may be because Black and Hispanic Americans are more likely to fear missing legitimate calls. 68% of Black Americans and 65% of Hispanic Americans are worried about this, compared to 56% of White Americans.

Where Voice Phishing Attacks Come From

Attackers initiate 71% of voice phishing attacks (National Science Foundation)

In an academic review of 86 distinct vishing attacks, the attacker initiated 61 of them.

Victims initiate 21% of voice phishing attacks (National Science Foundation)

Interestingly, victims were responsible for initiating over one-fifth of the 86 vishing attacks included in the study. The authors of the study were unable to determine who initiated the remaining 8% of vishing attacks.

Attackers posed as IT staff in ≥6 distinct voice phishing campaigns (CrowdStrike)

By posing as IT staff, scammers pretend to have the authority and reason to learn sensitive information from victims. They often use Microsoft Teams to conduct vishing attacks. 

Reasons Behind Vishing Attacks

51% of voice phishing attacks are conducted for monetary gain (National Science Foundation)

The other common aim was extracting information, which was the purpose of 45% of the 86 vishing attacks included in this study. In 4% of attacks, the goal was both information and monetary gain.

29% of voice phishing attacks are related to debt collection (National Science Foundation)

Debt collection is a surprisingly common expected benefit for vishing attacks. Other expected benefits include consumer products or services (40% of attacks), personal relationships (17%), prizes or grants (8%), and charitable donations (2%). 

Voice Phishing Tactics 

39% of voice phishing victims said the attackers knew their home addresses (Keepnet Labs)

Scammers often learn personal information about their would-be victims. This information allows them to present themselves as legitimate and convince (or threaten) their victim into compliance. 

Attackers use the fact that people are conditioned to respond to authority in 95.3% of voice phishing attacks (National Science Foundation)

“Authority” is considered one of several principles of persuasion in social engineering. People are generally conditioned to respect authority, something scammers almost always try to exploit. 

Other commonly used principles of persuasion are social proof, which describes how people tend to let their guard down when they feel like they’re going along with the crowd (90.7% of vishing attacks); distraction, which describes how people can become vulnerable when distracted, or tend to focus on one thing while missing others (89.5%); and liking, similarity, and deception, which describes how people tend to listen to those they like, are familiar with, or are attracted to (75.6%).

Two-thirds of voice phishing campaigns use spam bombing (CrowdStrike)

Spam bombing is a tactic where a victim’s inbox is flooded (or spammed) with many messages, some of them legitimate. The sheer volume overwhelms the victim and hides malicious activities. 

At least four of the six distinct vishing attack campaigns reviewed by CrowdStrike used spam bombing as a pretext for a vishing call. 

68.33% of voice phishing victims perceive their interaction with the bot attacker as realistic (ARXIV)

In this controlled experiment, over two-thirds of the 240 participants felt their interactions with the bot attacker were realistic. This, in turn, resulted in a higher chance that the vishing attack would be successful. 

Similarly, 46.25% of participants in the experiment said they felt the bot attacker was mostly or highly credible or trustworthy. That also led to a higher chance of a successful attack.

70% of spam calls in the US use number spoofing (Keepnet Labs)

When someone calls you, information about the caller usually appears on your caller ID display. Spoofing is a technique where a caller deliberately falsifies this information. Scammers often make it seem like their call is actually coming from a local number or from a trusted organization or government agency.

30% of organizations have reported voice phishing attempts in which attackers impersonated executives or senior officials (Hoxhunt)

Scammers often try to impersonate authority figures to convince their subordinates to commit risky acts. In fact, this tactic has its own name: CEO fraud.

The first known case of a vishing scammer using AI to impersonate an authority figure occurred in 2019, when a UK employee sent hundreds of thousands of dollars to someone pretending to be the head of a German company. 

85% of voice phishing attacks are sent using a free email service (Trellix)

Vishing campaigns often pretend to be from reputable organizations; popular choices include Norton, McAfee, Geek Squad, PayPal, and Amazon, according to Trellix.

A single vishing attack costs between $0.50 and $1.16 (ARXIV)

This is based on a controlled experiment using a custom AI-powered vishing bot called ViKing. Most of the cost of operating the bot came from subscriptions to the software powering it, including Chat GPT-4 Turbo, ElevenLabs, and Twilio. Because these services charge based on usage (e.g., per character or per minute), vishing attacks cost more when victims are better aware of the danger they are in and more resistant to being tricked.

AI Voice Phishing Statistics

Almost half of all businesses have been victims of deepfake voice phishing fraud (Regula Forensics)

This includes both audio and video deepfakes. That’s a significant increase from 2022, when 37% of businesses detected audio deepfakes, and just 29% detected video deepfakes.

A person’s voice can be cloned in three seconds (Microsoft)

Thanks to AI tools, attackers can replicate a person’s voice in seconds. With sufficient know-how, they can even hold real-time conversations while sounding like a completely different person. 

Scammers can replicate someone’s voice with only a small amount of data. They may obtain this voice data through a spam call, in which they prompt the victim into talking.

Listeners are unable to correctly spot deepfake audio 27% of the time (PLOS)

In the study, participants were usually able to spot deepfake audio, doing so 73% of the time. Interestingly, there was no significant difference in participants’ ability to identify deepfake audio in either English or Mandarin. 

56% of Americans feel threatened by attackers using AI-generated voices (Public Interest Network)

Over half of Americans feel threatened by AI-generated voices, with women 18% more likely to feel threatened by this than men. 

Defending Against Voice Phishing

AI-powered simulations of voice phishing attacks reduced the risk score of trained teams by 80% (Keepnet Labs)

Training is an excellent way to protect an organization against vishing. After just three months of training with AI-powered vishing simulations, organizations vastly reduced their risk of falling victim to a vishing attack.

Employees whose cybersecurity training programs include voice phishing simulations successfully respond to vishing attacks 90% of the time (Keepnet Labs)

Training isn’t foolproof, but it can help individuals correctly respond to vishing attacks with reliability. Having dedicated security analysts with an online bachelor’s degree ensures your organization has the internal expertise to consistently run these simulations and keep staff prepared.

Informing people about the dangers of sharing information makes them 39% less likely to do so during a voice phishing attack (ARXIV)

In a controlled experiment with 240 participants, 77% disclosed sensitive information during a vishing attack. But when participants were warned about the dangers of doing so, that rate fell to 52%. 

But even when strongly warned, 33% of people still disclose sensitive information during a voice phishing attack (ARXIV)

It seems that warnings can, unfortunately, only go so far in protecting individuals (and their organizations) from vishing attacks.

Around half of all organizations expect their telecom operator to protect them from voice fraud (Enea)

Telecom operators were seen by enterprises as the most important group for defending against vishing attacks. Enterprises ranked telecom operators above cloud providers, systems integrators, and direct software vendors.

75% of enterprises don’t invest in voice scam protection (Enea)

Despite the frequency of vishing attacks (and the chance for significant losses), the vast majority of enterprises specifically work to protect against vishing and other voice scams. Securing executive buy-in requires strategic leadership, which is why professionals with an online master’s degree in cybersecurity are so critical for designing (and implementing) enterprise-wide defense initiatives.

Just 44% of phone companies have fully installed the required anti-robocall software (PIRG)

As of September 2025, 9,242 phone companies have filed with the FCC. Unfortunately, just 4,084 of them have fully installed anti-robocall software, despite it being a legal requirement for operating in the US. Another 1,696 have installed the required software on part of their network, but not all of it, as required by law.

And 31.5% of phone companies haven’t installed the required anti-robocall software at all (PIRG)

That’s an increase of 342 from 2024.

59% of Americans never answer calls when they don’t recognize the caller (Public Interest Network)

The FCC advises people not to answer calls from unknown numbers and to hang up immediately if they do answer such calls. 

78% of Americans say they’d be more likely to answer a call if their caller ID screen displayed a verified business logo (Public Interest Network)

33% of Americans aged 18–34 said they would be much more likely to answer calls in this scenario. However, just 18% of Americans aged 45 and up said this. 

70% of Americans say it would be useful to have their calls automatically screened (Public Interest Network)

40% of Americans say they’d pay a premium for this sort of feature.