Your team has been trained to be suspicious of email. They hover over links, check sender addresses, forward the weird ones before clicking. That training worked — and attackers noticed. So they picked up the phone.
Voice phishing, or “vishing,” is a call from someone claiming to be your IT provider, your bank, your software vendor, or a coworker in another office. In 2026 it has moved from a fringe technique to one of the most common ways attackers get their first foothold in a company network — and it shows up in Tyler, Longview, and Palestine as reliably as anywhere else.
Here’s how these calls work, and the procedures that stop them.
Why Vishing Works Better Than Email
Three things make a phone call harder to defend against than an inbox.
There’s no artifact to inspect. A phishing email leaves evidence: a mismatched sender domain, a suspicious link, an attachment your filter can quarantine. A phone call leaves nothing. Your email security gateway, no matter how good, cannot scan a conversation.
Caller ID is trivially spoofed. The number on your screen is a suggestion, not a fact. Attackers routinely display the real main line of a bank, a vendor, or your own IT department. Employees taught to “check the number” are checking something the attacker controls.
Voice cloning is cheap. A few seconds of audio — a voicemail greeting, a chamber of commerce video on Facebook — is enough to imitate a specific person convincingly. The controller who gets a call from “the owner” approving an urgent wire is in a genuinely difficult spot.
Add ordinary courtesy and you have the whole problem: most people won’t hang up on someone who sounds professional and slightly stressed.
The Four Vishing Plays You’ll Actually See
Attackers are not endlessly creative. Nearly every vishing call against a small or mid-sized business fits one of four patterns.
1. The Fake IT Help Desk
The most common and most damaging. Someone calls an employee claiming to be from the company’s IT department or its managed IT provider. There’s a story: a security alert, a mailbox migration, a failed backup. The caller asks the employee to install a “diagnostic tool” — usually legitimate remote-access software like AnyDesk or ScreenConnect — or to read back an MFA code.
The variation that hurts most is the reverse: the attacker calls your help desk, poses as an employee locked out, and asks for a password reset or MFA re-enrollment. Now they have working credentials and a second factor they control.
2. The Vendor or Bank Callback
A caller from “your bank’s fraud department” needs to verify a suspicious transaction. A vendor needs license details before your service lapses. The goal is credentials, a code, or enough account detail to pass verification somewhere else.
3. The Executive Impersonation
The owner, CFO, or a partner calls the person who can move money. There’s a closing, an acquisition, a vendor threatening to halt a delivery. Payment details are new and it needs to happen today. This is business email compromise with the email removed — and for a family-owned dealership in Longview or a law firm in Tyler where the owner really does call about payments, it’s uncomfortably plausible.
4. Callback Phishing
An email arrives with no link and no attachment — just an invoice for a subscription you don’t remember buying and a number to dispute the charge. Nothing malicious is in the message, so it sails past filters. The attack starts when the victim calls.
Six Controls That Actually Stop Vishing
Awareness alone doesn’t work here. Under pressure, people default to procedure — so you need procedures worth defaulting to.
Establish a callback rule and make it non-negotiable
Nobody acts on an inbound call requesting credentials, codes, payment changes, or software installation. They hang up and call back on a number the business already has on file — the vendor number from the contract, the bank number on the back of the card, your IT provider’s published support line. Not a number the caller gave them.
Post the approved callback numbers somewhere visible. If the receptionist in Lufkin has to hunt for your MSP’s real number, she’ll use the one the caller offered.
Give staff explicit permission to hang up
This costs nothing and matters more than any tool. Say it out loud in a staff meeting: no one here will ever be disciplined for hanging up on a caller and verifying. Attackers rely on the social cost of seeming rude to someone claiming authority. Remove that cost and the technique loses most of its power.
Harden your help desk and reset process
Password resets and MFA re-enrollment are the crown jewels. Require verification an attacker can’t research: a manager’s confirmation through a separate channel, a video call, or a callback to the number in your HR records — not the number the caller is using. If your IT is outsourced, ask your provider what their reset verification procedure is. If the answer is vague, that’s your answer.
Deploy phishing-resistant MFA
If your second factor is a hardware security key or a passkey tied to the actual login page, there’s nothing for an employee to read aloud over the phone. A code the user can recite is a code the user can be talked out of. More detail in How to Set Up MFA That Attackers Can’t Bypass.
Lock down remote-access software
Most vishing calls end with the victim installing a legitimate remote-support tool. Use application allowlisting so unapproved remote-access software won’t run on a company machine, and standardize on one support tool your team recognizes on sight. When “IT” asks someone to install something unfamiliar, it should feel wrong immediately.
Require two people for any money change
New bank details, a new vendor account, an unusual wire — verified by a second person on a known-good number, no matter who asked or how urgent it sounds. Set a dollar threshold if you like, but set it low; attackers test with small amounts first. For CPAs and law firms handling client trust funds, and dealerships processing floor plan payments, this one control prevents the loss that actually ends businesses.
What East Texas Businesses Should Do This Month
Attackers doing reconnaissance don’t care whether you’re in Dallas or Palestine. They care whether you have money moving, staff who answer the phone, and a small IT team — which describes most of the manufacturers, medical practices, and professional firms between Texarkana and Lufkin.
Three steps for the next thirty days:
- Run a tabletop. Ten minutes in a staff meeting: “Someone calls claiming to be from our IT provider and asks you to install a support tool. What do you do?” You’ll find out fast whether your team knows the answer.
- Write down the callback numbers. One page, posted at every desk that handles money or account access.
- Ask your IT provider about their identity verification process for password resets and MFA changes — and how they identify themselves when they call you.
There’s a Texas-specific incentive too. Under SB 2610, effective September 2025, Texas businesses under 250 employees that maintain a documented cybersecurity program conforming to a recognized framework — NIST CSF, CIS Controls, ISO 27001 — gain a safe harbor against punitive damages in breach litigation. Written verification procedures and documented awareness training are exactly what that program is made of.
Dogwood Security helps East Texas businesses build these procedures and the controls behind them. Our cybersecurity services and managed IT teams do this work daily across Tyler, Longview, Palestine, Texarkana, Lufkin, and the DFW metro. Reach out and we’ll walk your process with you.
This Week in Security
A roundup of notable items from the past week, with an eye toward what matters for small and mid-sized businesses.
“Spring Ring” vishing campaign abuses Microsoft Teams — September 1, 2026. Palo Alto Networks’ Unit 42 detailed a coordinated voice-phishing campaign in which attackers created fake IT support accounts inside Microsoft Teams, then called employees and walked them through installing malware or granting remote access. If your organization allows external Teams messaging, that setting is worth revisiting this week. Help Net Security
SonicWall SMA 1000 appliances under active zero-day attack — September 2, 2026. SonicWall confirmed exploitation of two previously undisclosed flaws (CVE-2026-83548, CVE-2026-83549) in SMA 1000 remote-access appliances, chainable to unauthenticated remote code execution. CISA added them to its Known Exploited Vulnerabilities catalog the same day with a September 5 federal remediation deadline. Any business running an internet-facing remote-access appliance should confirm patch status now. Help Net Security · CISA KEV alert
Thomson Reuters discloses breach of court records platform — September 3, 2026. A breach of C-Track, a court case management platform run by Thomson Reuters subsidiaries, exposed court records and personal information across courts in at least 12 U.S. states, the U.S. Virgin Islands, and Canada. A reminder for law firms that your risk surface includes every platform your filings pass through. Help Net Security
FBI warns of OAuth consent phishing — September 2, 2026. The FBI issued a warning about attackers targeting individuals and their contacts with malicious OAuth app consent requests, gaining persistent access to email and files without ever capturing a password. Because the victim grants access voluntarily, changing the password afterward does not revoke it — you have to remove the app authorization. Worth auditing which third-party apps have access to your Microsoft 365 or Google Workspace tenant. Help Net Security
McKesson discloses third-party application breach — August 31, 2026. The healthcare distributor disclosed an incident in which attackers accessed third-party applications and stole data; the ShinyHunters group has claimed a very large volume of patient records. Claims from extortion groups are frequently inflated and the scope is still being established, but the pattern — attackers reaching healthcare data through a vendor’s application rather than the healthcare organization itself — is one every medical practice should be planning around. Help Net Security
Dogwood Security LLC is a veteran-owned managed IT, cybersecurity, and physical security company based in Palestine, Texas, serving Tyler, Longview, Texarkana, Lufkin, and the DFW metro.