Vishing and smishing
Also known as: vishing, smishing, voice phishing, SMS phishing, text scam
Vishing (voice phishing) and smishing (SMS phishing) are scams that reach you by phone call and text message instead of email.
Attackers impersonate banks, delivery firms, IT support, or government agencies to pressure you into clicking a link, sharing a code, or transferring money.
Vishing and smishing, explained at three levels
At home
Phishing usually arrives by email. Vishing and smishing are the same con coming through different doors: vishing is a scam phone call, and smishing is a scam text message. Think of a fake meter reader knocking instead of sending a letter. The caller or text pretends to be your bank, a courier, or a government agency and pushes you to share a code, click a link, or send money.
At work
Vishing (voice phishing) and smishing (SMS phishing) are social engineering attacks delivered by phone call and text message. They matter to a business because they bypass email filters entirely and reach staff on personal devices. Attackers use them to steal MFA codes, trick the help desk into resetting passwords, or pressure staff into payments, often by posing as IT support, executives, or suppliers.
At home
Both rely on spoofing, faking who the message appears to come from. The phone network lets callers set almost any caller ID, so a call can display your bank's real number. Texts can appear under a business name or land in an existing conversation thread. Smishing usually carries a short link to a fake page, while vishing uses a live voice to build pressure. In Canada, you can forward scam texts to 7726 to report them to your carrier.
At work
Business vishing often targets the help desk. An attacker calls posing as an employee locked out while travelling and asks for a password or MFA reset. Others call staff posing as IT and ask them to read out a code or install remote-access software like AnyDesk. Smishing campaigns impersonate the boss asking for gift cards, or send fake Microsoft 365 alerts. Caller ID authentication standards like STIR/SHAKEN help, but don't stop every fake caller.
At home
The most effective vishing combines a call with a real website. The attacker triggers a genuine password reset or login, which sends a one-time code to your phone, then calls posing as the fraud team and asks you to read it back to 'verify' you. You hand over a real code for their login. While caller ID filtering keeps improving, in my view the only reliable rule is never to share a code with anyone who called you.
At work
AI voice cloning can now imitate a specific executive from a short audio clip, defeating voice recognition as a trust signal. The 2023 MGM Resorts breach began with a phone call to the help desk. Strong controls include identity verification for every reset, such as a callback to the directory number or manager approval, pre-agreed code words for payment requests, phishing-resistant MFA that has no code to read out, and mobile threat defence for company phones.
Real-world examples
At home
Fatima received a text saying she owed a small unpaid road toll, with a link to pay. The link went to a look-alike site. She recognized the classic smishing pattern, didn't click, and checked the official toll account directly: she owed nothing.
At work
Thomas's help desk got a call from someone claiming to be a travelling salesperson locked out of email, urgently needing a password reset. Policy required verifying identity through a manager callback. The 'salesperson' hung up when asked: it was a vishing attempt.
How it compares
| feature | Vishing | Smishing |
|---|---|---|
| Channel | Phone call | Text message (SMS) |
| Common lure | Bank fraud dept, IT support | Delivery fee, toll, bank alert |
| Goal | Codes, resets, wire transfers | Click link, enter credentials |
| Spoofing used | Fake caller ID, voice cloning | Fake sender name, look-alike links |
| Best defence | Hang up, call back known number | Don't click; verify in official app |
For analysts
Extend your anti-fraud rules beyond email: no codes, passwords, or payment changes based on an unsolicited call or text. Train staff that hanging up and calling a known number is always the right move, never rude.
History & origin
As email filters improved and people grew wary of suspicious emails, attackers diversified into phone and text channels. Cheap voice-over-IP and bulk SMS made it easy to spoof caller IDs and blast messages to thousands. The 2020s saw a surge in smishing (fake delivery and toll notices) and AI-enabled vishing using cloned voices, making these channels a major fraud vector.