Voice phishing scams are getting harder to spot, and they’re not just an enterprise problem anymore. Here’s what business owners need to do now.

A hedge fund employee gets a phone call. The voice sounds exactly like a colleague, tone and pacing included. Within minutes, the caller has talked their way into a password reset. That scenario played out at several major investment firms in August 2026, when AI-generated voice cloning was used to target Point72, Citadel, and Millennium Management. Two Sigma caught the attempt before any damage was done, according to Bloomberg’s reporting.

Most small and mid-sized businesses don’t have that level of security scrutiny watching over them. This is vishing: voice phishing, where a scammer uses a phone call instead of an email to trick someone into handing over credentials, approving a wire transfer, or granting system access. It’s not a future threat. It’s active right now, and AI voice tools are making it more convincing every month.

Why Vishing Works So Well

People trust a human voice more than a written message, and criminals know it. According to Verizon’s 2026 Data Breach Investigations Report, phone-based social engineering succeeds roughly 40% more often per attempt than email phishing. Gartner research found that 35% of organizations have already experienced at least one deepfake-related incident, yet only 10% of security leaders prioritize training staff to recognize a cloned voice, compared to 73% who focus on email phishing alone.

The financial risk is real. In 2023, a vishing call to an IT help desk was the entry point for a breach that cost MGM Resorts an estimated $100 million.

Action Steps for Owners and IT

For the business owner:

• Set a rule that no wire transfer, password reset, or system access is approved based on a phone call alone. Require a callback to a known, independently verified number first.
• Build a culture where staff can pause and question an “urgent” request without fear of looking difficult.
• Schedule recurring, not one-time, staff training on phone-based scams.

For your IT team or provider:

• Enforce multi-factor authentication on every account that supports it, and never let it be disabled based on a phone request.
• Require independent identity verification before any help desk password reset.
• Document and block known scam and spoofed numbers where possible.
• Run periodic simulated vishing tests to find gaps before criminals do.

Questions Clients Are Asking

“How do I know if a call is legitimate?”
Hang up and call the company or person back using a number you already have on file, not one the caller gives you.

“What should my team do if they’re unsure?”
Stop, verify, then act. No legitimate request will penalize someone for double-checking.

“Can this really happen to a business our size?”
Yes. Smaller businesses are often targeted precisely because attackers assume less security is in place.

“What’s the first thing we should change?”
Put a callback verification policy in place this week. It costs nothing and closes the biggest gap immediately.

How Farmhouse Networking Can Help

Farmhouse Networking builds vishing and social-engineering awareness training around how your team actually works, not a generic slideshow. We run realistic simulated call scenarios, show you exactly where the gaps are, and help you put clear verification procedures in place your staff will actually follow. As a locally based, USA-only provider, we invest heavily in our own team’s ongoing security training, and we bring that same standard to yours.

Protect Your Business Before the Call Comes In

Vishing attacks succeed because they catch people off guard. A short, honest conversation now is a lot less costly than the one you’d have after a breach. Email us at support@farmhousenetworking.com for a free risk assessment. We’ll give you a clear picture of where your business stands, not just against vishing, but across your full security posture.