Vishing call fraud: how it works and how the scam runs

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Online fraud

Vishing is the voice version of phishing. The word is a blend of voice and phishing, and it describes a fraud carried out entirely or mainly over a phone call in which the caller impersonates an entity you trust. What makes vishing dangerous is not sophistication in the technology but skill in the conversation. A written lure must look plausible in print; a spoken lure only has to sound plausible for the length of one call. The caller can react to hesitation, answer objections, and manufacture urgency in real time, which no email can do.

The legal result is the same as in other digital frauds: where the caller obtains and uses your password, OTP or other unique identification feature to reach your account, Section 66C of the Information Technology Act 2000 is engaged, and where the caller cheats by personation using a communication device, Section 66D applies. The general offence of cheating under Section 318 of the Bharatiya Nyaya Sanhita 2023 runs alongside, and the impersonation of a public servant adds Section 319 of that Sanhita.

How the call actually runs

Vishing follows a recognisable sequence, and knowing the sequence is the best defence, because the victim who spots step two does not reach step five.

1. The approach. The caller opens with a claim that creates authority or alarm: a problem with your account, a pending delivery, a suspicious transaction, a tax notice or a police complaint registered in your name.
2. The reinforcement. Spoofed caller identification or a manufactured reference number is used to make the claim feel official, and the caller may pass the phone to a second voice playing a senior officer or a bank manager.
3. The isolation. The victim is told not to discuss the call with anyone, sometimes on the false ground that confidentiality is required, which cuts off the person who would have said stop.
4. The extraction. The caller asks for the OTP, the card details, the UPI PIN or the net-banking password, or instead asks the victim to install a screen-sharing application so that the caller can operate the device remotely.
5. The transfer and the close. The money moves during the call or immediately after, and the caller ends the conversation with reassurance, sometimes followed by a second call from someone posing as an officer who will help recover the loss.

What the law says

The Information Technology Act 2000 supplies the core charges. Section 66C punishes the fraudulent or dishonest use of another person's electronic signature, password or other unique identification feature, with imprisonment of up to three years and a fine of up to one lakh rupees, or both. Section 66D covers cheating by personation using a communication device or a computer resource, carrying the same punishment. Where the caller induces the victim to transfer money directly, the dishonest inducement is cheating under Section 318 of the Bharatiya Nyaya Sanhita 2023, and where the caller falsely claims to be a police officer or a government servant, Section 319 of the Sanhita is added.

Where the victim is tricked into installing a remote-access tool and the caller then operates the device, the unauthorised access and use of the computer resource engages the access and damage provisions of the IT Act 2000 as well, because the caller reaches a computer resource without the authorisation of the person in lawful charge of it. The point to hold on to is that impersonation over a phone call is not outside the law's reach; the medium is a communication device, which the statute names expressly.

The procedural route is set out in the Bharatiya Nagarik Suraksha Sanhita 2023. Information about a cognisable offence may be given to the police and, under Section 173, may be recorded electronically, which is what happens when a complaint is lodged through the national cyber crime portal. Section 175(3) requires the officer in charge of a police station to register a First Information Report and forward it to the magistrate without unnecessary delay. Section 35 allows another person to give information where the victim is a woman or a person incapable of reporting for themselves.

Why otherwise careful people comply

Victims of vishing are not, as a rule, gullible. The fraud is engineered against ordinary judgement under pressure. Authority is the first lever: a voice that sounds like a bank or a police officer suspends the instinct to verify. Urgency is the second, because the caller supplies a deadline that leaves no room to check. Secrecy is the third, because a victim who has been told the matter is confidential will not test the story on a family member. Finally, familiarity helps the caller, and details such as the last four digits of a card or a genuine transaction reference, gathered from an earlier breach or from a discarded receipt, make the claim ring true.

Understanding this matters legally as well as practically. A bank that receives a reversal request may argue that the customer was careless. The better response is not indignation but a factual account of the deception, because the question the bank must decide is whether the transaction was authorised by the customer in substance, not merely whether an OTP was typed at someone's insistence.

Red flags worth memorising

What to do in the first hour

1. Hang up and do not call back on the number that called you. Contact the institution using the number printed on your card or on its official website.
2. If you disclosed a credential, change the password and the PIN at once, and log out of active sessions on every device.
3. If money has moved, call 1930 immediately and file the report on cybercrime.gov.in, because a fast report gives the police the best chance of freezing the receiving account.
4. Email your bank's nodal officer, mark the transaction as unauthorised, and ask for the amount to be placed on hold.
5. If you installed a remote-access application, remove it, disconnect the device from any shared session and check for unfamiliar settings changes.
6. Save the call log, the number, and any messages or reference numbers the caller gave you, and put the whole account in writing in one place.

Who the caller pretends to be

The disguise varies with the victim's circumstances, and the variant is chosen to match what the target is most likely to fear or trust. The most common is the bank or wallet official, because almost everyone holds an account and the claim of a suspicious transaction is easy to believe. Next is the police or investigation officer, a persona that works by fear: the victim is told a parcel containing contraband was sent in their name, or that a complaint has been registered, and that cooperation on a call will resolve it. The courier or delivery variant exploits the volume of everyday online shopping, and the tax or refund variant arrives at predictable moments in the financial year. A further variant impersonates a telecom or utility officer and threatens disconnection. In each case the choice of disguise is not random; it is a guess about which authority the victim will not think to verify.

The practical lesson is that the title the caller gives is the least reliable part of the call. The genuine bank, the genuine police unit and the genuine tax department have one thing in common: none of them needs a password, an OTP or a screen-sharing session to do their work. A quick independent call back on a number the victim already holds, a look at the caller's claimed reference through an official portal, or simply cutting the call and checking with a family member defeats the disguise before it is used.

How the money actually leaves the account

Vishing rarely extracts money through one simple transfer. In the common pattern, the caller obtains enough to authenticate as the victim and then initiates a payment to a pre-positioned account, usually through an immediate payment channel such as UPI or an instant transfer, because those settle before a freeze can bite. Where the caller cannot authenticate alone and needs the victim's cooperation, the money is instead pushed out by the victim themselves, sometimes in several smaller transactions across different accounts to keep each one below a threshold that might attract a verification. Where a remote-access application has been installed, the caller can move funds from the victim's net-banking session directly and can also change contact details so that the bank's alerts do not reach the victim during the crucial minutes.

Once the money leaves, it is layered. A first receiving account, often a mule account opened with someone else's documents, receives the funds and moves them onward within minutes to further accounts, wallets or converted assets. This layering is the reason the freeze request attached to a 1930 complaint matters so much: it is most effective while the money is still in the first receiving account, and each onward hop reduces the chance of recovery. The victim's own records, the call log and the transaction reference, are what allow the police to ask the right institution for the right log at the right moment.

What decides the outcome

Speed of reporting is the single largest factor, because the reversal framework for unauthorised electronic transactions calibrates the customer's exposure to how quickly the loss was reported, and a same-day report gives the bank and the police the best chance of stopping the money. The second factor is whether the transaction can fairly be called unauthorised. A victim who was deceived into reading out an OTP is in a different position from a customer who knowingly approved a payment. The third is traceability: if the funds are still in the first receiving account, a freeze can hold them; if they have been layered onward, recovery becomes slower and less certain. The fourth is the strength of the record, because a complaint supported by the call log, the number and the messages moves faster than one built on recollection.

Mistakes that make it worse

• Calling the number back to argue, which re-establishes contact with the fraudster.
• Waiting to see whether the money returns on its own before reporting.
• Discussing the loss publicly and coaching other victims, which can contaminate evidence and attract copycat calls.
• Disclosing the OTP a second time to a caller who claims to be investigating the first fraud.
• Filing only with the local police station and not through 1930, which is the channel that carries the fastest freezing request.

When to involve a lawyer

Many vishing cases are resolved through the bank and the portal without legal help. A lawyer becomes useful when the bank resists on the ground that the customer authorised the transfer, when the loss is large enough to justify a civil claim against an identified beneficiary, or when you are being investigated because the funds landed in an account connected to you. In West Bengal, a case contested before the Bankshall Court or the City Sessions Court, with an appeal route to the Calcutta High Court, benefits from counsel who understands both the banking standard and the criminal standard. For a view of how the specialist practice handles these matters, see the page on the cyber crime lawyer in Kolkata service and the firm's contact page.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Vishing call fraud complaint: documents and timeline
• Matrimonial fraud: what it is and how it actually runs
• Trading app scam: what it is and how the fraud runs
• Stock market scam: how the fraud actually runs in India
• Sextortion: What It Is and How the Fraud Actually Runs
• Mutual fund scam: what it is and how the fraud runs

Cyber crime lawyer in your city · Bank account freeze help · Contact