What is vishing and why should your business care

Voice phishing — known as vishing — has rapidly become one of the most dangerous social engineering techniques targeting businesses of every size. When even Google, a company with arguably the most sophisticated security infrastructure on the planet, falls victim to a vishing attack, it sends a clear message: no organisation is immune.

The attack against Google demonstrated how skilled threat actors can manipulate employees through carefully crafted phone calls, bypassing technical defences entirely by exploiting human psychology. For European SMBs, particularly in Italy where digital transformation is accelerating but cybersecurity awareness often lags behind, this incident is a stark wake-up call.

How the Google vishing attack unfolded

The attack followed a pattern that security researchers have seen with increasing frequency. Threat actors impersonated trusted figures — in this case, posing as legitimate internal contacts or third-party partners — and used phone calls to extract sensitive information or convince employees to perform actions that compromised security.

What made this attack particularly effective was its multi-layered approach. The attackers combined voice calls with other social engineering techniques, including spoofed caller IDs and pre-researched details about the target employees. This level of preparation made the deception nearly indistinguishable from a genuine interaction.

According to the 2024 Verizon Data Breach Investigations Report, social engineering attacks account for roughly 17% of all data breaches, with vishing and pretexting incidents increasing by over 60% year-on-year. The FBI’s Internet Crime Complaint Center reported losses exceeding $12.5 billion from social engineering schemes in 2023 alone.

The anatomy of a vishing call

A typical corporate vishing attack follows a predictable structure that every business owner should understand:

Reconnaissance: attackers gather publicly available information from LinkedIn, company websites, and social media to build a credible pretext.
Initial contact: the call comes from a spoofed number that appears legitimate, often mimicking an internal extension or a known vendor.
Urgency and authority: the caller creates pressure, claiming to be from IT support, a bank, or a senior executive requiring immediate action.
Extraction: the target is asked to share credentials, approve a transaction, install remote access software, or bypass standard security procedures.

The entire interaction can last as little as three minutes. That is all it takes to compromise an organisation.

Why European SMBs are particularly vulnerable

Large enterprises like Google have dedicated security operations centres, red team exercises, and multi-million euro budgets for cybersecurity. Most European SMBs do not. This gap creates a disproportionate risk landscape.

In Italy, ISTAT data shows that over 95% of businesses are classified as small or micro-enterprises, many of which lack a dedicated IT security function. The Clusit 2024 Report on ICT Security in Italy recorded a 65% increase in cyber attacks targeting Italian organisations compared to the global average, with social engineering remaining one of the top attack vectors.

Regulatory pressure adds to the stakes

European SMBs also operate under the General Data Protection Regulation (GDPR), which imposes significant obligations around data protection. A successful vishing attack that leads to unauthorised access to personal data can trigger mandatory breach notifications to the Garante per la Protezione dei Dati Personali and potentially result in fines of up to €20 million or 4% of global annual turnover.

The NIS2 Directive, which EU member states were required to transpose into national law by October 2024, further expands cybersecurity obligations to a broader range of businesses, including many medium-sized enterprises in critical sectors. Non-compliance is not just a technical risk — it is a legal and financial one.

Practical defences against vishing attacks

The good news is that defending against vishing does not require Google-level budgets. It requires awareness, process, and consistency.

Build a human firewall

Technical controls cannot fully protect against attacks that target people directly. Regular security awareness training that includes realistic vishing simulations is the single most effective countermeasure. Employees should learn to recognise the telltale signs of a vishing attempt: unexpected urgency, requests to bypass normal procedures, and pressure to act without verification.

Training should not be a one-time event. Quarterly exercises, combined with brief refresher sessions after real-world incidents make headlines, keep awareness levels high. Studies by the SANS Institute show that organisations conducting regular phishing and vishing simulations see a 70% reduction in successful social engineering attacks within the first year.

Implement verification procedures

Establish clear policies that no sensitive action — transferring funds, sharing credentials, granting system access — should ever be completed based solely on a phone call. Every request must be verified through a separate, trusted channel.

For example, if someone calls claiming to be from your bank, hang up and call the bank’s official number directly. If an “IT technician” requests remote access, confirm through your company’s internal ticketing system. These simple steps break the attacker’s script.

Strengthen technical safeguards

While vishing is fundamentally a human-targeted attack, technical measures provide valuable layers of defence:

Multi-factor authentication (MFA) ensures that stolen credentials alone are not enough to gain access.
Call authentication protocols like STIR/SHAKEN help verify caller identity, though adoption across European telecoms is still evolving.
Endpoint detection and response (EDR) tools can catch malicious software installed during a vishing attack.
Privileged access management limits the damage an attacker can do even if they compromise a single account.

Lessons from Google’s experience

If there is one takeaway from the Google vishing incident, it is this: security is never purely a technology problem. The most advanced firewalls, intrusion detection systems, and AI-powered threat monitoring tools cannot prevent an employee from being deceived by a convincing voice on the phone.

For Italian and European SMBs, the priority should be clear. Invest in your people first. Create a culture where employees feel empowered to question unusual requests without fear of reprimand. Document and enforce verification procedures for every sensitive operation. And stay informed — threat actors continuously refine their techniques, and your defences must evolve with them.

The attack on Google was not an isolated event. It was a signal that vishing has matured into a professional, scalable threat. The question for every business is not whether they will be targeted, but whether they will be ready when the call comes.

Need support on this topic? Contact us for a free consultation — let’s assess your company’s situation together.

Stay updated every week on cybersecurity, AI and technology for SMBs: subscribe to our newsletter.