Phishing vs Vishing vs Smishing: How Phone Scams Differ

Scammers use the same basic playbook — impersonate someone trustworthy, create urgency, and get you to hand over money or personal information. What changes is the channel: email, phone calls, or text messages. Knowing the difference helps you recognize red flags the moment they appear, no matter how the contact reaches you.

What is phishing?

Phishing is the original term, referring to fraudulent emails designed to look like they come from a bank, delivery company, employer, or government agency. These emails usually contain a link to a fake login page or an attachment carrying malware. While phishing itself happens over email, it often overlaps with phone scams: a phishing email might ask you to "confirm your account" by calling a number that connects you to a scammer, or it might follow up with a phone call to add pressure.

Common phishing signs

• Generic greetings like "Dear Customer" instead of your name
• Urgent subject lines about account suspension or unusual activity
• Links that don't match the company's actual website when you hover over them
• Requests to "verify" a password, card number, or one-time code

What is vishing?

Vishing ("voice phishing") is phishing conducted through a live phone call or automated voice message. A caller might claim to be from your bank's fraud department, a tech support line, a courier, or a tax authority. Vishing is often more convincing than email phishing because a real-time conversation lets the scammer react to your questions, sound sympathetic, and pressure you before you have time to think.

Callers frequently use caller ID spoofing, making the number that appears on your phone look like it belongs to a legitimate organization or even a local number. Just because a call appears to come from your bank does not mean it actually did.

Common vishing signs

• Pressure to act immediately — "your account will be frozen in 10 minutes"
• Requests for a one-time passcode, full card number, or online banking password
• Instructions to move money to a "safe" account they control
• Refusal to let you call back on an official number you look up yourself
• A recorded message asking you to press a number or stay on the line, then transferring you to a live "agent"

What is smishing?

Smishing ("SMS phishing") delivers the same kind of scam through text messages. A text might claim you have a package waiting, an unpaid toll, a bank alert, or a prize, along with a link to click or a number to call. Because text messages are short and often read quickly on a small screen, people are less likely to scrutinize them the way they might a longer email.

Smishing often works together with vishing: you get a text warning of "suspicious activity," and when you call the number in the message, you're connected to a scammer posing as support staff.

Common smishing signs

• A link using a shortened or unfamiliar web address
• Messages about deliveries, tolls, or payments you don't recognize
• A sense of urgency combined with a request to click or call right away
• Messages from a number that isn't the company's normal short code or contact number

How the three overlap

Modern scams rarely stick to a single channel. A typical sequence might look like this: a text (smishing) tells you your parcel delivery failed, the link leads to a fake site that asks for your card details (phishing), and if you hesitate, you get a follow-up call (vishing) from someone claiming to be support, using the details you already entered to sound convincing. Recognizing this pattern is more useful than memorizing which term applies to which step.

What to do if you're contacted

• Do not click links or call numbers provided in an unexpected message — look up the organization's contact details yourself, from its official app, website, or the back of your card
• Never share one-time passcodes, PINs, or full card numbers with anyone who contacts you first
• Hang up or ignore messages that pressure you to act within minutes
• If a call or text claims to be from your bank, call the number on your card or statement to verify separately
• Check the number that contacted you using a reputation-lookup service before calling back or replying
• Report suspicious calls to your mobile carrier and suspicious texts by forwarding them if your carrier supports it
• If you already shared information, contact your bank immediately using the number on your card and consider reporting the incident to your national consumer-protection or anti-fraud authority

The bottom line

Whether a scam arrives by email, phone call, or text, the underlying tactics are the same: impersonation, urgency, and a request for something valuable — your money, your credentials, or your trust. Slowing down, verifying independently, and never acting on pressure alone will protect you regardless of which channel a scammer chooses.