FBI Warns Smishing and Vishing Scams Are Targeting High-Profile Individuals

The Threat: Smishing & Vishing Campaigns

The FBI has issued an alert that cybercriminals are using text messages and AI-generated voice recordings to impersonate senior U.S. government figures. The goal? To build trust and then trick recipients into clicking malicious links or revealing sensitive data.

These actors often claim to be transitioning to a different messaging platform—perhaps a common excuse like “Let’s move this to Signal/WhatsApp”—before sending a malicious link. Once clicked, the attackers can steal login credentials or install malware to gain access to personal or official accounts.

Even more dangerous, once attackers compromise one account, they often use it as a launching pad to impersonate the victim and reach out to others in their contact list.

Smishing, Vishing & Spear Phishing — What’s the Difference?

• Smishing: Phishing attempts via text messages (SMS/MMS). Scammers often use fake numbers or impersonate familiar contacts.
• Vishing: Phishing through voice calls or messages, increasingly using AI-generated voices to sound like trusted individuals.
• Spear Phishing: Highly targeted email scams that often precede or accompany smishing and vishing efforts.

What makes these attacks especially dangerous is their personalized and convincing nature, often leveraging public data and social engineering tactics.

How to Spot a Scam

Cybercriminals are getting smarter, but there are still red flags you can look for:

• Unfamiliar Numbers: Always verify the identity of the sender or caller using a trusted source.
• Unusual Language or Requests: Is the tone off? Are they asking for urgent help or money? Be skeptical.
• Suspicious Links or Attachments: Never click or download anything unless you’re absolutely sure it’s legitimate.
• Visual/Audio Inconsistencies: Look for distorted images or strange voice characteristics—like unnatural tone, lag, or incorrect phrases.

Steps to Protect Yourself and Your Team

1. Verify Before You Trust
   Double-check requests—even from people you know—via a trusted method or contact.
2. Don’t Share Sensitive Info
   Never share login credentials, verification codes, or personal data through unverified messages.
3. Enable Multi-Factor Authentication
   And never share your MFA codes. If someone’s asking for them, it’s likely a scam.
4. Set Up a Family/Friend Verification Phrase
   Create a “safe word” to confirm identities in case of suspicious contact.
5. Be Cautious with Downloads and Links
   Avoid clicking links or downloading files from unknown or unverified sources.

Next Steps

Worried about threats to your organization’s network? Contact us today for a free consultation at 703-790-0400 or sales@optfinITy.com.