CompTIA PenTest+ (PT0-003)Attacks and ExploitsMedium
An attacker calls a company's help desk, impersonating a traveling executive who claims to be locked out, and convinces the technician to reset the executive's password over the phone. Which social engineering technique was used?
- AVishing
- BWhaling
- CTailgating
- DSmishing
Show answer & explanationAnswer & explanation
Correct answer: A. Vishing
Vishing (voice phishing) involves using a phone call to manipulate a target into divulging information or performing an action, exactly as described. Smishing uses SMS text messages, whaling is a phishing attack that specifically targets executives (the attacker here is impersonating one, not targeting one via email), and tailgating is a physical access technique.
Why the other options are wrong
- B. Whaling refers to targeting an executive as the victim, typically via email, not impersonating one over the phone.
- C. Tailgating involves physically following someone into a secured area.
- D. Smishing relies on SMS/text messages, not phone calls.
Vishing
A social engineering technique that uses phone calls to trick a victim into revealing information or performing an unauthorized action.
- Voice + phishing = Vishing
- Often impersonates executives, IT, or vendors
- Effective against help desks due to urgency and authority
Memory trick: 'Vishing = Voice fishing on the phone'