Vishing
Vishing is fraud by phone in which a caller impersonates a trusted organization to obtain information or trigger a payment. The caller may claim to be a bank employee investigating a security problem and ask for a transaction code or approval in an app. Pressure and an apparently familiar caller number can make the request seem credible despite the false identity.
A code or approval obtained during the call can give the fraudster access to an account or authorize a transfer. The number shown on a phone does not by itself prove that the call comes from the bank or another named organization. Ending the call and contacting the institution through a known, independently obtained number separates the request from the caller's claims.
How a vishing call works
The BSI describes callers who pretend to be police, bank staff or IT support, create urgency or a threat, and collect personal data during the call. In a bank case the caller asks the customer for a TAN or to approve a request in the banking app. The BSI suggests agreeing on a code word with the bank.
The 2025 report on payment fraud by the EBA and the ECB counts such cases as manipulation of the payer, which rose to 74 percent of the value of fraudulent credit transfers in 2024. The report names vishing next to phishing and smishing as the techniques behind it, and social networks as a source of the personal details that make a call convincing.
Spoofed numbers and section 120 of the Telecommunications Act
A vishing call often shows a number the customer trusts. Section 120 of the German Telecommunications Act limits that trick: a German number may be displayed as the caller only when the call comes from the German public telephone network. If a call with a German number arrives from a foreign network, the display is suppressed. Roaming calls in mobile networks are exempt.
A number on the display alone still does not prove who is calling. The BSI advises hanging up and checking the request through another channel, such as a call to the bank on its known number.
Authorized or not: who pays after a vishing call
Liability after vishing depends on who pressed the button. If the caller obtains a TAN and initiates the transfer, the payment is unauthorized, the bank refunds it under section 675u of the Civil Code and the customer carries the loss only after gross negligence. If the customer sends the money personally, it is an authorized payment, the case covered on the APP fraud page.
The Payment Services Regulation closes part of that gap. According to the European Parliament, when a scammer poses as an employee of the customer's payment service provider and the customer approves a payment, the provider must refund the full amount if the customer reports the fraud to the police and informs the provider. Before a euro transfer, the verification of payee check also shows whether the name matches the IBAN the caller dictated.
Upcoming events on fraud and payments in Germany
What is the difference between vishing, phishing and smishing?
All three are attempts to get login data or a payment by posing as a trusted organization. Phishing usually means email, smishing means SMS and vishing means a phone call. The phishing in banking page covers the email and SMS variants.
What should you do when the bank calls?
The BSI advises sharing no personal data on the phone, hanging up and checking the request through another channel, for example by calling the bank on its known number. A code word agreed with the bank helps to tell a real call from a fake one.
Vishing and Finance Loop
Finance Loop is the meeting place for the fraud and payments teams that handle bank impersonation cases in Germany, Austria and Switzerland. Finance Loop announced KI Exchange 2026 in Hamburg, whose program included fraud detection with AI.
Finance Loop is a professional network supporting the institutional use of emerging technologies in finance, such as AI, digital payments, cloud and blockchain solutions. Finance Loop helps its members build skills and personal networks in these fields: Investment & Digital Assets, Payments & Digital Money, Digital Infrastructure & Sovereignty, and Risk & Compliance.