Two separate phishing attacks this week have used a new technique in which VoIP systems are used to imitate a bank's call centre.
The phishing emails are fairly standard, warning of a problem with the user's account and asking them to get in touch.
But the emails give a phone number leading to a VoIP account, with an operator on the end pretending to be from the bank in question or an automated system asking for account details.
"We have seen two separate VoIP attacks hit our network this week, the first we've been able to analyse in detail," said Adam O'Donnell, senior research scientist at anti-spam firm Cloudmark, which detected the attacks.
"In a VoIP phishing attack, the phone system identifies itself to the target as the financial institution and prompts them to enter account number and Pin. The result can be financially devastating."
VoIP-based services allow phishers to add and cancel phone numbers that are harder to trace than conventional numbers.
HomePod delay means Apple will miss Christmas sales
Reports of Toshiba PC sale plans come after it sold its TV manufacturing unit to Hisense
IoT Accelerator programme intended to stimulate tech investment in Wales
Vote follows claims of Russian interference, even though Clinton out-spent Trump 2-to-1