Vishing Attacks on Jamaica Businesses: How Phone Fraud Works and How to Stop It

Why Jamaican Businesses Are Being Targeted by Phone Fraud

Vishing — voice phishing — is fraud that plays out on a live phone call. A caller convinces a staff member that they represent someone trustworthy: a bank officer, an IT technician, a government official, or even a senior colleague. Once trust is established, the caller extracts something of value — a password, a transfer authorisation, an account number, or access to an internal system.

Jamaica's business community has seen a sharp rise in sophisticated phone fraud since 2024. Fraudsters have learned that email spam filters catch many phishing attempts, but a well-crafted phone call can bypass almost every technical control a business has in place. The target is rarely the business owner directly — it is the person who answers the phone on your behalf.

Kingston offices, Montego Bay contact centres, and small professional practices across the island have all been affected. Understanding how these attacks work is the first step in stopping them.

How a Vishing Attack Actually Works

Most vishing attacks follow a pretext script — a plausible story designed to make an abnormal request feel routine. These are the most common scenarios reported by Jamaican businesses:

• The fake bank call: A caller claims to be from your business bank's fraud department. A suspicious transaction has been flagged. To protect your account, they need you to confirm your online banking credentials or authorise a "reversal transfer."
• The fake IT support call: A caller says they are from your software vendor or internet service provider. There is an urgent security issue with your account and they need remote access or a password reset to resolve it immediately.
• CEO fraud by phone: The caller impersonates a director or senior manager — sometimes using a spoofed number that looks like an internal extension or a known mobile — and instructs the finance team to process an urgent wire transfer before end of day, with instructions not to use normal channels.
• The fake government officer: The caller claims to be from Tax Administration Jamaica, the Financial Investigations Division, or another authority, pressuring staff to confirm business registration details or make an immediate payment to avoid a penalty or prosecution.

What makes these attacks work is the combination of urgency and apparent authority. The caller creates pressure — this must be resolved now, do not tell your manager, act before it is too late. Under that stress, a well-meaning staff member makes a decision they would never make calmly.

Warning Signs Your Staff Must Recognise

Train every person who handles inbound calls at your business to recognise these red flags the moment they appear:

• Artificial urgency: "This must be resolved in the next 20 minutes or your account will be suspended." Legitimate institutions do not create deadlines like this on an inbound call.
• Requests for credentials: No bank, vendor, government agency, or employer will ever ask for a password on an inbound call. This is an absolute rule with no exceptions.
• Instructions to keep the call secret: "Do not mention this to your manager" is a manipulation tactic, not a compliance requirement. Any caller who says this is attempting to isolate your staff member from their support network.
• Caller ID that does not match the story: A number that looks local, official, or familiar is easy to spoof. The digits displayed on your screen are not proof of identity — they are only a display.
• Unusual payment requests: Any instruction to pay via wire transfer to an unfamiliar account, cryptocurrency, gift cards, or mobile money should be escalated immediately without exception.

If a call is legitimate, the caller will not object to you hanging up and calling them back on a published number. If they pressure you not to hang up, that pressure itself is the clearest warning sign available.

Technical Controls That Help — and Their Limits

Modern cloud phone systems give businesses tools that make vishing harder to execute successfully:

• Call recording: Every inbound contact is captured as an audio file. If a fraudulent transaction occurs, you have a full record for investigation, law enforcement reporting, and insurance purposes. This closes cases that would otherwise go unresolved.
• Full call history by number: Cloud PBX portals show every call from a given number across your entire account history. A caller claiming to be your long-standing bank contact can be cross-checked in seconds — if they have never called your business before, that is immediately visible.
• Supervisor monitoring and flagging: Staff can flag a call as suspicious in real time, escalating it to a supervisor without interrupting the conversation or alerting the caller.
• Extension-level access restrictions: Accounts payable extensions can be configured so that no payment or transfer can be approved based on a phone instruction alone. The policy becomes a system-level control, not just a personal judgement call.

Technology supports your defence but does not complete it. A persuasive caller bypasses every technical control the moment a staff member decides to comply with what they are told. Policy and training remain the primary line of defence.

Building a Phone Security Policy for Your Jamaica Business

A phone security policy does not need to be long. It needs to be clear, written down, and rehearsed until the right response is automatic. These are the four rules every Jamaica business should have in place:

• Verify before you act: Any phone request involving money, credentials, or access to systems must be verified by calling the requestor back on a known, published number — not the number that just called. Look the number up independently; do not use a number provided by the caller.
• Two-person rule for financial instructions: No payment, transfer, or account change should ever be authorised on the instruction of a single phone call, regardless of who the caller claims to be or how urgent they say it is.
• Escalate immediately: Any call that felt unusual, pressured, or suspicious must be reported to a manager before any action is taken — even if the staff member did not comply. Log the incident regardless of outcome.
• Pre-authorise your vendors: Know in advance which vendors will ever call your business and exactly what they are and are not allowed to request. Your cloud PBX provider, for example, will never ask for your admin password on an inbound call.

Run a brief drill every six months. Have a trusted colleague call a front-desk staff member posing as a vendor with an urgent credential request. The goal is not to catch anyone out — it is to make the correct response automatic before a real attacker tries it.

How WOCOM's Platform Supports Your Fraud Defence

WOCOM Cloud PBX gives businesses across Kingston, Montego Bay, and the rest of Jamaica the infrastructure to take phone security seriously. Call recording is built into every account. The admin portal provides full visibility of inbound and outbound call history by number, by extension, and by time period. Suspicious patterns — repeated contact attempts from the same number, calls targeting specific extensions, calls at unusual hours — become visible in your dashboard before they escalate into incidents.

WOCOM's AI receptionist adds a first-contact layer, handling and logging all inbound calls before they reach a staff member, and routing interactions to the right person with call context already attached. Staff are never caught off guard by an unfamiliar caller with no history in your system.

For businesses in financial services, professional services, and any sector handling sensitive client data, WOCOM's call recording and logging capabilities also support compliance with Jamaica's Data Protection Act requirements around incident documentation.

Protect Your Business Starting Today

Vishing attacks succeed because the targeted business was not prepared. The preparation is not expensive or time-consuming — it is a short policy document, one training session with your team, and the right phone infrastructure behind it.

WOCOM serves businesses across Jamaica with cloud PBX, SIP trunking, and AI call handling that includes call recording, full call logging, and the dashboard visibility you need to manage your inbound call security effectively.

Contact WOCOM today and ask about Cloud PBX packages with built-in call recording for your Jamaica business. Our team will walk you through the setup, the security features, and the steps that close the gaps fraudsters look for.