A phishing attempt does not need to arrive by email. It can appear as a text saying your bank account has been locked, a message claiming a parcel cannot be delivered, or a phone call from someone who sounds calm, professional and urgent.
When phishing is delivered through text messages, it is commonly called smishing. When it is delivered through voice communication, it is called vishing. CISA describes smishing as phishing through text messages and vishing as phishing through voice communication. The Federal Trade Commission also defines smishing as SMS phishing that tries to push the recipient toward a malicious link, phone number or conversation.
The channel changes, but the core manipulation is the same: an attacker creates a believable story, gives you a reason to act, and tries to move you toward a decision before you independently verify the situation.
If you already understand email phishing, the most important difference here is not the attacker’s goal. It is the psychology of the medium. A text message feels immediate. A phone call creates social pressure. Both can make a false request feel more trustworthy than it actually is.
Smishing and vishing in plain language
Smishing is phishing through SMS, messaging apps or similar text-based channels. A message may ask you to click a link, call a number, install an app, send a one-time password, confirm payment details or continue a conversation.
Vishing is phishing through a phone or voice call. The caller may pretend to be from a bank, government agency, delivery company, employer, technical support team or even someone you know. CISA notes that attackers can use Voice over IP services to spoof caller ID, which is one reason a familiar-looking phone number cannot be treated as proof of identity.
A useful mental model is:
The message or call starts the story. Verification should happen somewhere else.
That means you do not verify a suspicious bank text by clicking the bank link inside the text. You open the bank app you already use or call the number printed on your card. You do not verify a caller claiming to be from an agency by calling the number they dictate. You locate the organisation’s official contact details independently.
Why smishing works so well
Text messages are short, immediate and often read on a phone while the user is doing something else. That creates several advantages for an attacker.
First, a small mobile screen hides context. A shortened or lookalike URL may be harder to inspect carefully. Second, real organisations do send legitimate SMS alerts, delivery updates, login codes and fraud notifications. That makes the attack plausible. Third, attackers can create pressure with a very small amount of text.
Common stories include:
- a bank fraud alert asking you to confirm a transaction;
- a parcel delivery problem that requires a small payment;
- an unpaid toll, fine or account charge;
- a job offer or task-based earning opportunity;
- a message from an unknown person that develops into a longer scam conversation;
- a security warning asking you to verify your login.
The FTC’s analysis of text-message scams reported in 2024 found that fake package delivery, bogus job opportunities, fake bank fraud alerts, unpaid toll messages and wrong-number scams were among the commonly reported themes. The FTC reported $470 million in consumer losses from scams that started with text messages in 2024. That figure describes reported text-message scams overall, not smishing alone, but it shows why text-based social engineering deserves serious attention.
Why vishing can feel even more convincing
A phone call has a different advantage: it creates real-time social pressure.
The caller can react to hesitation, change the story, answer questions and create urgency. They may sound patient rather than aggressive. They may know your name or other personal information from previous data exposure. They may even spoof the caller ID so that the display appears to show a bank, government office or local number.
The FTC explicitly warns that caller ID can be faked. CISA has also documented impersonation scams where callers claimed to represent CISA employees and advised recipients to hang up and validate the contact through an independently obtained official number.
This is why voice quality, confidence and caller ID are weak identity signals. A person can sound legitimate and still be lying about who they are.
The attack path is usually more important than the wording
People often look for spelling mistakes, unusual grammar or an obviously suspicious number. Those clues can still help, but they are no longer reliable enough on their own.
NIST warns that AI can be used to create increasingly convincing phishing messages. A well-written message is therefore not evidence that the sender is genuine.
A better method is to examine the requested action.
| Request | Why it matters | Safer response |
|---|---|---|
| Click this link to fix your account | The link controls where you go | Open the official app or type the known website yourself |
| Read me the code you just received | The code may approve a login or transaction | Never share authentication codes with an unexpected caller |
| Install this support app | The app may grant remote access | End the call and contact official support independently |
| Move your money to keep it safe | The request tries to create urgency around irreversible action | Stop and contact your bank through a known channel |
| Confirm your password or card details | Legitimate identity checks should not require disclosure of secrets to an unsolicited caller | Use the organisation’s official app, website or branch |
This approach is more durable because scam wording constantly changes while the underlying goals remain similar.
A realistic smishing example
Imagine you receive this message:
BANK ALERT: A payment of Rs. 48,900 was attempted.
If this was not you, verify now: example-security-check.testThe safe question is not, “Does the message look professional?”
The safe question is, “Why should I trust the link provided by the same message that created the problem?”
If the alert is real, the transaction should also be visible through the bank’s known application, official website or verified customer-service channel. Open that trusted channel separately. Do not use the link in the text as your verification method.
The same principle applies if the text asks you to call a phone number. Find the number independently instead.
A realistic vishing example
Suppose a caller says they are from your bank’s fraud team. They know your name and the last few digits of your account. They warn that someone is transferring money and ask you to read out a one-time code so they can stop it.
The information they know may make the call feel authentic, but it does not prove identity. Partial personal information can come from leaked data, public sources or previous scam interactions.
The critical clue is the requested action: they want an authentication code.
End the call. Open your banking app or call the number printed on your bank card. If there is a genuine fraud event, the bank can handle it through its official process. A legitimate investigation does not require you to surrender an authentication secret to an unexpected caller.
SMS and voice codes are not the strongest form of MFA
Multi-factor authentication is still much safer than relying on a password alone, but not every MFA method provides the same resistance to phishing.
CISA recommends phishing-resistant MFA where possible and ranks hardware security keys above authenticator apps, with text or email codes among the weaker options. CISA’s joint phishing guidance also explains how SMS or voice MFA can be exposed through SIM-swap attacks or real-time phishing where a victim enters a password and one-time code into a fraudulent site.
This does not mean SMS MFA is useless. It means you should not treat an SMS code as harmless information. A six-digit code can be the final factor an attacker needs.
For higher-value accounts, prefer phishing-resistant methods such as FIDO-based security keys or passkeys when the service supports them.
What to do when an unexpected text arrives
Do not reply simply to find out whether the sender is legitimate. The FTC advises users not to respond to unexpected texts and not to click links in them.
Instead:
- Stop and read the request, not just the story.
- Do not click the link or call the supplied number.
- Open the relevant official app or website separately.
- If necessary, contact the organisation using a number you already trust.
- Report or block the message using your phone’s built-in tools or your mobile provider’s process.
In the United States, the FTC recommends forwarding unwanted scam texts to 7726 (SPAM). Reporting channels differ by country and provider, so use your local operator’s official instructions where applicable.
What to do when an unexpected call becomes suspicious
A suspicious call does not need to be debated. You are allowed to end it.
If the caller claims there is an urgent problem with an account, payment or identity:
- do not disclose passwords, PINs, card security codes or one-time passwords;
- do not install remote-access software because the caller tells you to;
- do not transfer money to a supposedly “safe” account;
- do not trust caller ID as identity proof;
- hang up and contact the organisation independently.
The FTC repeatedly warns consumers not to move money because an unexpected caller says it is necessary to protect an account. That instruction itself is a strong fraud signal.
What if you already clicked a smishing link?
Clicking a link does not automatically mean your account is compromised, but it changes what you should do next.
If you clicked but entered nothing, close the page. Make sure your device and browser are updated. If a file or application downloaded, do not open it unless you can verify it independently. Remove suspicious downloads and use your device’s normal security scanning tools if appropriate.
If you entered a password, change that password immediately using the real service, and change it anywhere else you reused it. Review active sessions and security alerts. Turn on MFA if it was not already enabled.
If you entered a one-time code, assume the attacker may have used it in real time. Check the account immediately, sign out other sessions if the service allows it, and contact the provider if you see an unfamiliar login or transaction.
If you entered payment-card or banking information, contact the financial institution through its official channel and follow its fraud response process.
What if you already gave information to a caller?
The response depends on what was disclosed.
A name or email address creates a different level of risk from a password, bank PIN, remote-access session or one-time authentication code. Prioritise the secrets that can directly enable access or payment.
A sensible response order is:
- Secure the affected account from a trusted device.
- Change exposed passwords and revoke suspicious sessions.
- Contact the relevant bank, service provider or employer if sensitive financial or work information was involved.
- Review account recovery methods in case they were changed.
- Preserve the phone number, message and time of contact if you need to report the incident.
If an attacker persuaded you to install remote-support software, treat the device as potentially exposed until the software is removed and the system has been checked.
How organisations can reduce smishing and vishing risk
Security awareness helps, but organisations should not place the entire burden on users.
A strong design reduces the number of situations in which an employee must decide whether a message is genuine.
Useful controls include:
- phishing-resistant MFA for important accounts;
- clear internal rules stating that help-desk staff will never ask for passwords or MFA codes;
- known callback procedures for financial or privileged actions;
- approval workflows for unusual payments or sensitive changes;
- mobile-device management and controls around app installation where appropriate;
- security training that includes SMS, messaging apps and voice calls, not only email;
- incident reporting channels that are easy to use when an employee is uncertain.
CISA’s phishing guidance specifically covers SMS, chat platforms and voice spoofing, which is a reminder that modern phishing defence has to extend beyond the email gateway.
The verification rule that works across channels
The most useful habit is simple:
Do not use the suspicious communication as the tool for proving that the communication is genuine.
If a text creates the alert, verify through a different trusted channel. If a caller creates the emergency, end the call and initiate a new contact using official information you obtain independently.
This works because it breaks the attacker’s control over the interaction.
Smishing and vishing are not special because they use new technology. They are effective because familiar communication channels create trust quickly. The defence is to separate urgency from verification and to make sensitive actions depend on independently trusted channels, strong authentication and clear organisational procedures.
For a broader explanation of the same social-engineering principles, see What Is Phishing?. If you are building security awareness into a wider career or team-development plan, Cybersecurity Career Paths Explained also shows how defensive operations, governance and security engineering approach human and technical risk from different angles.