Vishing isn’t theoretical. It’s happening every day, and most companies don’t even know they’ve been compromised.

This post breaks down one of our real-world voice phishing simulations and what it revealed about an otherwise mature security program.

The Objective: Breach by Phone

A global retailer hired us to test their frontline defenses, specifically their customer support and IT helpdesk. There was no email, no malware, just phone-based social engineering.

Our only tools:

• OSINT (public employee info, org structure, naming conventions)
• A VoIP system with caller ID spoofing
• Skilled vishing operators

The Challenge: Employee ID Validation

The target used employee IDs with a specific # of digits as part of their identity verification process. We didn’t have any valid ones, and they weren’t provided.

So we guessed.

Literally.

Using a dial-in phone tree, we manually tested ID combinations until we found working ones. It was slow...but it worked. A few were invalid. Some were active. 

Building the Attack Chain

Once we had valid IDs and matching names, we:

• Confirmed internal call tree structure

• Verified naming conventions

• Spoofed a legitimate internal number

• Got routed through to a support agent

• Attempted a password reset under a believable pretext

We didn’t pull the trigger on the reset because of client rules. But a real attacker would have.

The Defense Reacts...But Not Fast Enough

Within hours of our first wave of calls, the organization changed its internal protocols, and authentication prompts were modified.

That’s good defense. But by the time they adjusted, we were already three moves ahead.

What This Tells You

If your organization can be breached in five days by two people with phones, imagine what a threat group with months of time and zero ethical constraints could do.

You don’t know how vulnerable your people are until you test them.

Want to See the Full Kill Chain?

Download the Lares Vishing Methodology
We break down every phase of our engagements so you can learn how real attackers operate.
Get the playbook

Test your team with a custom vishing simulation
Schedule a meeting with Lares