Phishing, Smishing, Vishing, and QRishing. All of these schemes continue to pose risk to organizations that needs to be assessed and addressed.

Vishing made a strong debut during the pandemic [view related post], and continues to be a scheme that is surprisingly successful.

This week, Morgan Stanley Wealth Management (in the wake of another data breach that was recently settled), notified some of its customers that their accounts were compromised by threat actors impersonating Morgan Stanley employees. According to Morgan Stanley, on February 11, 2022, a threat actor called some of Morgan Stanley’s clients and tricked them into thinking the caller was a Morgan Stanley representative, obtained the customers’ online account information, and gained access to the accounts.

Once that was done, the “bad actor…initiated unauthorized Zelle payments.”

Morgan Stanley disabled the accounts of the customers that were affected by the Vishing scheme and has confirmed that its systems remain secure. It also provided resources to customers on Vishing attacks and how to prevent them.