Vishing is phishing by phone, and deepfakes are AI-generated voices or video that imitate a real person. Together they let an attacker sound like a colleague, supplier or manager. For OT teams the risk is not that someone is fooled by an email about a parcel; it is that someone approves a remote session, resets a password or registers a new MFA device for a caller who is not who they claim to be.
What the evidence says
Google's Mandiant M-Trends 2026 report, covered by The Register, found that voice phishing was the initial access method in 11 per cent of the 2025 intrusions Mandiant investigated, the second most common after exploiting vulnerabilities (32 per cent). Non-interactive lures such as phishing email fell to 6 per cent. Mandiant described attackers phoning IT help desks to register their own device for multi-factor authentication and then resetting passwords. The report is general to all sectors, not specific to OT.
Deepfakes raise the stakes. In 2024 engineering firm Arup confirmed that an employee in Hong Kong had been deceived by a video call featuring fake versions of senior colleagues and sent about US$25 million to fraudsters, as widely reported at the time. It was a finance fraud, not an OT incident, but it shows that seeing and hearing someone is no longer proof of identity.
Where OT is exposed
- Help desks and service desks that can reset credentials or enrol MFA devices, including those that support engineering accounts.
- Vendor remote support. A caller claiming to be from the controller or SCADA supplier asks to be let in "urgently" to fix a fault.
- Operators and shift staff who are asked by phone to change a setpoint, disable an alarm or approve a session.
- Procurement and finance processing a change of supplier bank details.
- Shared and generic accounts, where one convincing call gives access to many systems.
Operational pressure helps the attacker. Outages, shift handovers and weekends are exactly when people are most inclined to help.
Controls that hold up against fakes
- Verify by a second channel you already trust. Call back on a number from your own records, never one the caller supplies.
- Make vendor access a booked process. Remote sessions should be requested in advance, approved by a named internal owner, time-limited and monitored. An unscheduled "emergency" request should trigger extra checks, not fewer.
- Harden resets and MFA enrolment. Require strong proof before resetting credentials or adding devices, and prefer phishing-resistant authentication such as FIDO2 security keys where possible.
- Separate OT identities. Do not let a compromised corporate account become an OT login. Keep jump hosts and OT directories distinct.
- Remove standing access. Accounts that are disabled by default give a successful call far less to work with.
- Agree a code phrase or challenge for critical requests such as changing process settings, and train staff that it is fine, and expected, to refuse to proceed.
- Rehearse. Run a tabletop on "a vendor calls asking for access to the substation network" and fix the gaps it exposes.
Regulation points the same way. NIS2 requires basic cyber hygiene and cybersecurity training as part of risk-management measures in the EU. IEC 62443 addresses identification and authentication (FR 1) and use control (FR 2), which are the controls a social engineer tries to bypass.
How OTVista helps
OTVista turns these controls into a recorded process. Remote Access tracks who may reach which systems and through which approved path, Identity & Access keeps accounts and roles visible, and Governance holds the procedures and approvals. A practitioner can help you write policies and procedures, review your architecture for access paths, or deliver OT security training that includes realistic call scenarios. Start with the free Quick Check.
Related: Secure remote access for OT vendors.
Sources: Google Cloud Mandiant M-Trends 2026 as reported by The Register (23 March 2026); public reporting on the 2024 Arup deepfake fraud; Directive (EU) 2022/2555 (NIS2); IEC 62443-3-3 foundational requirements. Figures describe Mandiant's investigated intrusions across all sectors. This article is general information, not legal advice.
Topics: vishing, deepfake fraud, AI social engineering, OT remote access security, help desk social engineering, deepfake voice attack, OT cybersecurity