Vishing — voice phishing — is when attackers call you instead of emailing you. It's more effective than email phishing because people are harder to say no to in real-time conversation. The urgency of a live call bypasses the skepticism most people have developed toward emails.
Common scenarios: someone calls claiming to be your bank's fraud department (your card was just used in another state, they need to verify your full card number to secure it); IT helpdesk calls to fix an 'urgent security issue' on your account and needs your password; Medicare calls about a new card and needs to confirm your SSN.
The rule is simple: you cannot verify who called you. Caller ID is trivially spoofable — any number can be made to appear as any other number. The 'bank fraud' caller showing 1-800-YOURBANK is not necessarily your bank.
If the call seems legitimate: hang up, find the real phone number yourself (from the back of your card, the official website, or your statement), and call back. If the situation was real, they'll understand. If they pressure you not to hang up — that pressure itself is the tell.
Real banks, real IT departments, and real government agencies do not ask for full passwords, PINs, or one-time codes over the phone. Ever. These are your credentials. No legitimate system needs to verify them by having you read them aloud.