Legal and compliance

Is vishing testing legal? Consent, recording laws and two-party states

Yes, when the organization being tested has approved it in writing, the call recording rules of every state involved are followed, and counsel has reviewed the use of AI voices. Federal law needs the consent of only one party to record a call, but about a dozen states require everyone on the call to agree. This is general information, not legal advice.

By . Published . Last updated .

Key takeaways

  • Written authorization from the organization being tested is what separates a security test from fraud.
  • Federal law needs one party's consent to record, but about a dozen states require every party to agree, so assume the strictest rule applies.
  • AI-generated voices are covered by US telephone consumer law, and its reach to internal security tests is an open question for counsel.
  • Banks and credit unions should design scenarios so the caller never collects real customer data.
  • Tools help, but you stay responsible for recording and consent rules where you call.

This is general information, not legal advice. Laws differ by state and country and change over time. Have your own counsel review your program before you launch a campaign.

Security teams run vishing simulations routinely. Whether yours is lawful depends on three things you control: written authorization, the rules for recording the call, and the rules for the technology on the call, including AI voices. This post walks through each, then gives a checklist.

1. Do you need authorization to run a vishing test?

Yes. Get it in writing before any call.

A vishing test is a deliberate deception. What separates a security test from fraud is that the organization has approved it. That means a signed authorization from someone with the power to approve it, a defined scope (which people, which numbers, which dates) and rules of engagement (what the caller may ask for and what is off limits). If you are testing a client, get this from the client in writing before any call. If you are testing your own employees, get it from the executives or legal owner who is accountable for the program.

One related statute is worth knowing about. The Gramm-Leach-Bliley Act makes it unlawful to obtain customer information of a financial institution through false pretenses (15 U.S.C. § 6821). That law is about financial institution customer information, not pretexting in general. If you test a bank or credit union, design the scenario so the caller never collects real customer data, and have counsel confirm the approach.

2. Do you need consent to record a vishing test?

Under federal law, one party's consent is enough. The Wiretap Act says it is not unlawful to intercept a call where you are a party to it, or where one party has given prior consent, unless the purpose is a crime or tort (18 U.S.C. § 2511(2)(d)). That is called one-party consent. A caller recording its own call is a party to it, so federal law alone does not stop you from recording.

The catch is that state law can be stricter.

3. Which states require everyone on the call to consent to recording?

Roughly a dozen states require every party to a call to consent to recording. The states most often listed are:

  • California
  • Delaware
  • Florida
  • Illinois
  • Maryland
  • Massachusetts
  • Montana
  • Nevada
  • New Hampshire
  • Pennsylvania
  • Washington

Lists differ on the edges. Connecticut, for example, is one-party for criminal liability but imposes civil liability for recording phone calls without all-party consent, so many businesses treat it as an all-party state. Some lists add other states. Treat any list, including this one, as a starting point and check the current statute for each state where your targets sit and where your calls originate.

In practice, the safest approach is to assume all-party rules apply. Employers often handle this through an acceptable use or monitoring policy that tells staff that calls may be recorded, together with the written authorization described above. Whether that satisfies a given state is a question for counsel. It is not something a tool can settle for you.

4. Can you use AI voices for vishing tests?

AI voices are covered by US telephone consumer law, so get legal advice before using them. In February 2024 the FCC ruled that AI-generated voices count as an "artificial or prerecorded voice" under the Telephone Consumer Protection Act (summary by Wilson Sonsini). Calls that use one generally need the called party's prior express consent, unless an exemption applies.

Two points here are not settled and are worth raising with counsel. First, the TCPA is mostly applied to commercial and marketing calls, and we found no authority that applies it to an authorized, non-commercial security test, or that rules out doing so. Second, commentary generally treats mobile numbers as more protected than business landlines, and it is unclear how an employer-issued mobile phone is treated. Many programs reduce risk by calling business lines, by documenting the authorization and by getting legal review of the consent basis.

The FTC Telemarketing Sales Rule defines telemarketing as a campaign to induce the purchase of goods or services or a charitable contribution (16 CFR 310.2). A security test sells nothing, so the rule looks aimed at something else, but that is a reading of the definition and not a ruling on vishing tests.

5. AI disclosure laws

Some states have rules about telling people when they are speaking with AI. Utah's AI Policy Act, for example, has required disclosure of generative AI in consumer interactions since May 2024, at least when the consumer asks (Sheppard Mullin overview). California changed its rules for automated prerecorded calls as of January 2025. These laws are written for consumer and commercial settings, and we did not find a source applying them to internal security tests, so this is an open question to take to counsel. The area is also moving quickly, so check for new rules before each program.

6. Outside the United States

Rules differ elsewhere. In the EU and UK, programs generally document a legitimate interest under the GDPR and keep data collection minimal, and some countries have extra rules about recording calls. If you test employees outside the US, get local advice before you start.

A pre-launch checklist

  1. Written authorization from the organization being tested, signed by someone with authority.
  2. Defined scope: who is called, which numbers, which dates and which pretexts.
  3. Rules of engagement: what the caller may ask for, what is off limits, and what happens if a target becomes distressed.
  4. Recording basis: decide how consent to recording is handled in every state involved, and assume the strictest.
  5. Legal review of the program, including the AI voice and telephone-consumer rules above.
  6. Data handling: limit who can hear recordings, set a retention period, and do not collect real credentials.
  7. A debrief plan so employees are told afterward and trained, not punished.

What vishin.ai does and does not do

vishin.ai's terms require customers to have written authorization before they run a campaign and to follow the laws on telephone calls, recording and employee monitoring. A campaign cannot launch until an authorized person in your organization approves it, and that approval is recorded with who signed off and when. Recordings and transcripts are stored in your isolated tenant and are accessible only to your authorized users.

Those controls support a compliant program. They do not make a program compliant on their own. You remain responsible for the recording and consent rules in the places you call. See the terms of service and privacy policy for the details.

Sources