Phishing, Smishing, and Vishing: What Each One Means

The Same Scam, Three Different Channels

Phishing, smishing, and vishing are all forms of impersonation fraud — criminals pretend to be a trusted institution (a bank, the IRS, a delivery service) to steal personal information, passwords, or money. What separates them is the delivery channel they exploit.

Understanding how each one works helps you recognize the warning signs before they cost you. These attacks rely on psychology, not advanced hacking — which is why knowing the tactic matters more than knowing the technology. See how that works in our look at how scammers use social engineering to bypass your common sense.

Phishing, Smishing, and Vishing Defined

Phishing arrives by email. A message appears to come from a legitimate sender — your bank, a streaming service, even a colleague — and urges you to click a link or open an attachment. The link typically leads to a convincing fake website designed to harvest your login credentials or payment details. Attachments may install malware.

Smishing (SMS + phishing) uses text messages. Because people tend to trust texts more than emails and open them faster, smishing can be especially effective. A common smishing message claims your package couldn't be delivered and asks you to click a link to reschedule — that link leads somewhere malicious.

Vishing (voice + phishing) happens over the phone. A caller impersonates a bank fraud department, a tech support agent, or a government agency. They create urgency — telling you your account has been compromised or you owe back taxes — and pressure you to provide information or transfer funds immediately. Robocall technology makes it easy to reach millions of people at low cost.

Once you can name these tactics, you're better positioned to spot the specific red flags each one leaves behind. Our guide on warning signs that an email, text, or website isn't what it claims walks through those signals in detail.

What to Do When You Suspect an Attack

The most important habit across all three attack types is simple: don't act under pressure. Urgency is the scammer's most reliable tool. Pause, verify independently, and never use contact information provided in the suspicious message itself.

• Phishing emails: Don't click links. Go directly to the organization's website by typing the address yourself, or call a number from the official website.
• Smishing texts: Don't tap links in unsolicited texts. If a delivery notification seems suspicious, track your package through the carrier's official app or site.
• Vishing calls: Hang up. Call the organization back using a number from their official website or your card's back panel. No legitimate agency will demand immediate payment by gift card or wire transfer.

You can report suspected phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org, smishing texts by forwarding them to 7726 (SPAM), and vishing calls to the FTC at ReportFraud.ftc.gov.

This article is for general informational purposes only. For guidance specific to your situation — especially if you believe you've already been targeted — contact your financial institution and relevant authorities directly.