Phishing vs. Smishing vs. Vishing: How to Spot Each Type of Attack

Three messages land on the same afternoon. One is an email warning that your bank account has been locked. One is a text about a parcel that could not be delivered. One is a phone call from a polite man who says he is from IT support and needs to fix something on your laptop. Different channels, same objective: to get a password, a payment, or a six-digit code out of you.

Phishing is the family name for all of it. Smishing is the text-message branch, vishing the voice-call branch. The scripts are often nearly identical, which is why learning to spot the pattern matters more than memorising individual scams.

Phishing: the email version

Email phishing remains the most common because email is cheap, scalable, and easy to disguise. A typical campaign copies a real company's branding, sends you to a lookalike login page, and harvests whatever you type. Others skip the fake page and simply attach a file that asks you to enable macros or enter a password to "view the document".

Red flags to check before you click

• The address, not the name. Display names are trivial to fake. A message from "Your Bank" sent by billing@yourbank-secure-alerts.net is not from your bank.
• Manufactured urgency. "Account suspended within 24 hours", "final notice", "unauthorised login detected". Real organisations give you time and a way to verify independently.
• A generic greeting. Your bank knows your name. "Dear Valued Customer" usually means a mass send.
• Mismatched links. Hover over a link on a computer, or press and hold it on a phone, to see the real destination before tapping.
• Requests that no legitimate service makes. Nobody needs your full password, your one-time codes, or a gift card number to fix an account problem.

If an email appears to come from a company you actually deal with, close it and log in through your own bookmark or app instead. If the warning is real, it will be waiting for you there.

Smishing: when the bait arrives as a text

Texts feel more personal than email, and that is exactly why they work. The screen is small, the message is short, and the sender's number is easy to spoof. Common themes include failed deliveries, unpaid tolls, bank fraud alerts, unpaid invoices, job offers, and messages that appear to come from a family member with a new number asking for help.

The phone format hides trouble well: a long web address is often truncated, so a link can look harmless while leading somewhere else. Watch for these signs.

• A message from an unknown number that still uses your name or references an order.
• Links with odd endings, misspellings, or shortened domains such as bit.ly and similar.
• Pressure to reply "Y" or "N", which confirms your number is live and brings more messages.
• Anything asking you to read a code back, or to send money to someone you cannot call on a number you already trust.

The safest response to an unexpected text is to not reply at all. Deleting it removes the temptation; forwarding it to your carrier's spam-report number, where one is offered, helps everyone else. If you are unsure whether a delivery notice is genuine, open the courier's website yourself and paste in the tracking number.

Vishing: the call that sounds official

Vishing is phishing done by voice, and it is the most convincing of the three because a live person can answer your objections. Caller ID is not proof of anything, and recorded voice samples make it possible for a scammer to imitate a relative or a colleague. Typical scripts claim your account has been compromised, your computer has a virus, your tax filing is wrong, or a fraud team needs to "secure" your money by moving it.

Red flags on the phone

• The caller asks you to stay on the line while you log in to your bank or open your computer.
• They request a one-time passcode, a PIN, or remote access to your device.
• They tell you to keep the call secret from family, staff, or your bank.
• They want payment by gift card, crypto, or bank transfer rather than a normal card payment.
• They refuse to let you call back on the number printed on your card or statement.

You are allowed to hang up. That single act defuses nearly every vishing call. Call the organisation back using a number you looked up yourself, and if the call was genuine, the person on the other end will not mind.

The pattern behind all three

Change the channel and the ingredients stay the same: someone impersonates an authority you already trust, invents a deadline, asks for something that should never be shared, and pushes you to act before you think. Email, text, and voice simply deliver that script in different wrappers.

Legitimate organisations do not need your password, your one-time codes, or remote control of your device to help you.

If you have already responded

Mistakes happen, and speed matters more than embarrassment. Work through these steps in order.

1. Break contact. Hang up, stop replying, and close the page. Do not send more information to fix the first mistake.
2. Secure your accounts. Change the password for anything you entered, use a different password for each service, and turn on two-factor authentication.
3. Check for unwanted access. Look for unknown devices, forwarding rules, and recent logins on your email and banking accounts, and remove anything you do not recognise.
4. Call your bank or card issuer directly if you shared card details or sent money. Ask them to freeze or reverse the payment, and follow their instructions. For anything involving significant sums, a disputed transaction, or legal exposure, speak to your bank and, if needed, a qualified professional.
5. Clean your device if you installed remote-access software. Disconnect from the internet, uninstall the tool, run a full scan, and ask a technician you trust if you are unsure.
6. Report it. Tell your IT team at work, your bank, and your national fraud or cybercrime reporting service. Reporting helps protect the next person, even when your own money is gone.

A habit that beats all three

You will not out-memorise every scam, so borrow one rule instead: verify through a channel you chose. Open the app, dial the number on your card, walk down the hall and ask the colleague who supposedly emailed you. Scammers depend on you staying inside the conversation they started, and that is the only thing they cannot survive. Tell the people around you about the messages you receive, too. A five-minute chat with a parent or a new colleague is often what stops the next payment.

Photo: Brett Jordan / Pexels