Vishing: voice-phishing cost, the helpdesk-impersonation pivot, and the 1,633% surge

Vishing (voice phishing) is the phone-call variant of social-engineering attack. It pre-dates the email phishing era and was, for two decades, the lowest-leverage attack vector in the practitioner mind because the per-call effort was high and the conversion rate was low. The 2024-2025 wave inverted both variables. The MGM Resorts incident of September 2023 demonstrated that a single successful helpdesk call could yield 9-figure damage, and the commoditisation of voice-cloning software through 2024 collapsed the per-call effort to near zero. The category is now the fastest-growing phishing variant by year-on-year incident count.

The per-incident cost figure of $1.35M is the median across the 2026 vishing cohort tracked by IBM Cost of a Data Breach 2025 and IC3 2024 voice-channel categories. The distribution is bimodal: the typical helpdesk-impersonation event lands in the $400K to $800K band (credential reset, mailbox-takeover containment, modest data-exfil exposure), and the typical major-pivot event (Scattered Spider class, ransomware-handoff) lands in the $5M to $100M band. The median between the two modes sits at $1.35M.[IBM 2025 + IC3 2024 voice category + Hoxhunt 2026]

On 7 September 2023, a member of the Scattered Spider threat group placed a call to the MGM Resorts IT helpdesk impersonating an employee whose name, role, and reporting line had been harvested from LinkedIn. The helpdesk technician, working from the standard service-desk runbook, performed the MFA reset that the caller requested. Attackers used the reset access to enter the MGM environment, escalate privileges, and deploy ransomware across major systems. The disruption forced MGM to take down hotel-room keycard systems, casino slot machines, restaurant point-of-sale terminals, and the central booking platform.

MGM disclosed the financial impact in its Q3 2023 10-Q filing as approximately $100M, comprising direct disruption cost, customer-refund exposure, and the cost of system rebuild. The figure does not include subsequent litigation or the reputation drag on the brand. Caesars Entertainment, hit by the same group in a parallel attack, reportedly paid approximately $15M in ransom and did not experience the same disruption profile because their incident response chose to settle rather than fight through the recovery. The contrast between the two outcomes drove an industry-wide reassessment of the ransomware-payment-versus-recovery cost calculus.

The MGM defender lesson is that the entire breach traced to a single phone call to a service-desk runbook that did not require video verification or out-of-band confirmation for an MFA reset. The runbook update across the casino-resort sector in the months following the incident was immediate and aggressive: every major operator added mandatory video-verification or in-person confirmation for any MFA reset by Q1 2024. Across the broader US enterprise market, the runbook update is still in progress; mid-market and SMB IT helpdesks frequently still perform phone-based MFA resets with no additional verification.[MGM 10-Q Q3 2023 + Scattered Spider attribution per Mandiant]

The technical inflection that drove the 2024-2025 vishing surge was the commoditisation of voice-cloning tools that need only 60 seconds of source audio to produce a usable real-time clone. Pre-2023, voice cloning required either a large source-audio corpus (hours) or a professionally-trained voice imitator. The 2023-2024 model wave compressed the requirement to a one-minute LinkedIn-video clip or a podcast appearance, and the inference latency dropped to near-real-time on consumer hardware.

The attacker cost picture: sub-$10 per month for consumer-grade hosted services that produce a real-time clone from 60 seconds of source audio. Free, for open-weight models that run locally on a gaming-tier GPU. Source audio is universally available for any named senior executive through earnings calls, conference recordings, podcast appearances, and corporate communications. The attacker can in practice produce a deepfake-voice clone of any executive at any public company in under one hour at zero meaningful marginal cost.

The defender implication is identical to the whaling case: in-channel verification (the legacy callback procedure that asks the caller to verify identity by stating non-public details) no longer works because the attacker can hold a voice conversation in real time with the cadence, pitch, and verbal mannerisms of the impersonated person. Verification has to operate through a different channel or through a knowledge-based challenge that the attacker cannot brute-force in conversation. The Ferrari procedural defence (asking about a recently-recommended book) is one example; the whaling page details the broader procedural-control library.[Hoxhunt 2026 + ENISA AI Threat Landscape 2024]

Vishing cost composition differs from BEC and whaling because the dominant pivot is not a wire transfer; it is a credential takeover that enables downstream pivot. The wire-loss line is typically small (or zero, for helpdesk-pivot events) and the IR and pivot-containment lines are large.

Composition extracted from the IBM 2025 voice-vector cohort with the customer-disruption line cross-referenced against the MGM and Scattered Spider event disclosures of 2023-2024.[IBM 2025 voice cohort + MGM Q3 2023 disclosure]

The vishing control surface is the IT helpdesk runbook. The single most-pivotal procedural decision is whether MFA reset, password reset, and account-unlock can be performed via inbound phone call alone. Post-MGM, the right answer for any organisation with credible exposure is no. The control set below ranks by per-dollar reduction in modelled vishing loss.

Three threat-actor groups dominate the 2024-2026 vishing landscape. Knowing the group helps size the likely pivot path.

• All phishing attack vectors
• Whaling and CEO fraud cost
• Smishing cost
• MFA fatigue phishing cost
• Deepfake vishing cost (extended)
• Phishing cost in financial services
• Cofense cost (helpdesk-attack modules)
• mdrcost.com
• edrcost.com
• databreachcost.com