Vishing: the call from a fake bank employee
Vishing is phishing by phone: a caller poses as the bank's security team, the police or IT support and talks the customer into giving away a TAN or approving a payment. In Germany, a call from a foreign network may not display a German number, and the EU payments rules add a refund for bank impersonation. Dated events on fraud and payments are in the calendar below.
How a vishing call works
The BSI describes callers who pretend to be police, bank staff or IT support, create urgency or a threat, and collect personal data during the call. In a bank case the caller asks the customer for a TAN or to approve a request in the banking app. The BSI suggests agreeing on a code word with the bank.
The 2025 report on payment fraud by the EBA and the ECB counts such cases as manipulation of the payer, which rose to 74 percent of the value of fraudulent credit transfers in 2024. The report names vishing next to phishing and smishing as the techniques behind it, and social networks as a source of the personal details that make a call convincing.
Spoofed numbers and section 120 of the Telecommunications Act
A vishing call often shows a number the customer trusts. Section 120 of the German Telecommunications Act limits that trick: a German number may be displayed as the caller only when the call comes from the German public telephone network. If a call with a German number arrives from a foreign network, the display is suppressed. Roaming calls in mobile networks are exempt.
A number on the display alone still does not prove who is calling. The BSI advises hanging up and checking the request through another channel, such as a call to the bank on its known number.
Authorized or not: who pays after a vishing call
It depends on who pressed the button. If the caller obtains a TAN and initiates the transfer, the payment is unauthorized, the bank refunds it under section 675u of the Civil Code and the customer carries the loss only after gross negligence. If the customer sends the money personally, it is an authorized payment, the case covered on the APP fraud page.
The Payment Services Regulation closes part of that gap. According to the European Parliament, when a scammer poses as an employee of the customer's payment service provider and the customer approves a payment, the provider must refund the full amount if the customer reports the fraud to the police and informs the provider. Before a euro transfer, the verification of payee check also shows whether the name matches the IBAN the caller dictated.
Upcoming events on fraud and payments in Germany
What is the difference between vishing, phishing and smishing?
All three are attempts to get login data or a payment by posing as a trusted organization. Phishing usually means email, smishing means SMS and vishing means a phone call. The phishing in banking page covers the email and SMS variants.
What should you do when the bank calls?
The BSI advises sharing no personal data on the phone, hanging up and checking the request through another channel, for example by calling the bank on its known number. A code word agreed with the bank helps to tell a real call from a fake one.
Vishing and Finance Loop
Finance Loop is the meeting place for the fraud and payments teams that handle bank impersonation cases in Germany, Austria and Switzerland. Finance Loop announced KI Exchange 2026 in Hamburg, whose program included fraud detection with AI.
Finance Loop is a professional network and has the goal of driving the adoption of emerging technologies in finance, such as AI, digital payments, cloud and blockchain solutions. Finance Loop helps its members build skills and personal networks in these fields: Investment & Digital Assets, Payments & Digital Money, Digital Infrastructure & Sovereignty, and Risk & Compliance.