Pindrop Security observed more than one million instances of vishing, or voice phishing from July-December 2011 in the U.S. and found that fraudulent callers used registered phone numbers and caller IDs to pose as legitimate organizations requesting customer information most prominently in 30 of the 50 largest banks. As more individuals become targeted in vishing attacks, it is more critical for companies to learn how to protect themselves and their customers from falling victim.

In response to these findings, Pindrop Security has released the industry’s first State of Phone (News - Alert) Fraud Report, highlighting the behavioral trends of vishers and outlining where institutions and customers are most vulnerable. The 10 most targeted cities also include Los Angeles, Atlanta, Chicago, Houston, and Kent, Wash. The report ranks New York City and Washington, D.C. as the most targeted cities for phone fraudsters, with more than 20,000 vishing incidents detected.

Vijay Balasubramaniyan, founder and CEO of Atlanta-based Pindrop Security, shed some light on this growing threat.

“New York City is a confluence of a significant number of banks and a significant population of people to create the perfect storm,” he told TMCnet.

The total number of detected vishing incidents increased 52 percent since June 2011, and growing consumer concern around identity theft and personal security with almost 190,000 fraudulent calls observed in December. Surprisingly, while the frequency of vishing hits increased significantly, the amount of unique phone numbers used in such attacks increased by only 5 percent, indicating that vishers are succeeding in acquiring information by using the same numbers in multiple scenarios.

All five of the largest national financial institutions, and 30 of the top 50, were targeted by vishers during the second half of 2011. Fraudsters used an average of 200 numbers to contact customers assuming the identity of such prominent institutions. Vishing (News - Alert) statistics also found a 20 percent overlap in the phone numbers targeting the two largest national banks, indicating greater persistence from fraudsters to reach a wide audience from a single source.

More than half of vishers leveraged VoIP connections, rather than mobile or landline phones, to contact victims.

“VoIP services have become the easiest outlet for Caller ID spoofing as they allow fraudsters to remain anonymous, are cheap and allow an easy way to do bulk calling to a large number of consumers,” Balasubramaniyan explained. 

Balasubramaniyan provides some tips for people dealing with this problem in their homes and at their businesses. Local consumers should watch out for the recent growth of caller ID spoofing as a fraud tool, creating greater vulnerability for call recipients. In these incidents, vishers overtake registered phone numbers and caller IDs to pose as a bank or company, and request personal information from consumers who falsely believe the call is legitimate.

“Treat a call from an enterprise/financial institution asking you for personal information with caution. It is always good to hang up the phone and call a number for that enterprise/financial institution that you are know of,” he said.

Pindrop provides enterprise solutions that help prevent phone-based fraud. Pindrop’s breakthrough technology is the first of its kind to fingerprint individual phone calls, providing verification of caller provenance. Recently named one of the 10 Most Innovative Companies at the 2012 RSA (News - Alert) conference, Pindrop’s solutions help companies feel more confident in the security of phone-based financial transactions.

“Pindrop's acoustical fingerprinting technology analyzes calls and provides a customizable risk score for these calls. This risk score provides actionable intelligence that helps enterprises eliminate financial losses and reduce operational costs,” said Balasubramaniyan.

In the next year, as part of Pindrop Security’s product roadmap, a smartphone app will be introduced to help people know when they are getting a call from a legitimate enterprise or a fraudulent caller, serving as an alternative to Caller ID.