Two separate phishing attacks this week have used a new technique in which VoIP systems are used to imitate a bank's call centre.
The phishing emails are fairly standard, warning of a problem with the user's account and asking them to get in touch.
But the emails give a phone number leading to a VoIP account, with an operator on the end pretending to be from the bank in question or an automated system asking for account details.
"We have seen two separate VoIP attacks hit our network this week, the first we've been able to analyse in detail," said Adam O'Donnell, senior research scientist at anti-spam firm Cloudmark, which detected the attacks.
"In a VoIP phishing attack, the phone system identifies itself to the target as the financial institution and prompts them to enter account number and Pin. The result can be financially devastating."
VoIP-based services allow phishers to add and cancel phone numbers that are harder to trace than conventional numbers.
Microsoft comes up with a new way to foist its unloved and little used Edge web browser on people
Insider claims Cambridge Analytica used academic app to filch Facebook data of 50 million users
Is the Samsung Galaxy S9+ worth its high price?