Smishing vs. Phishing vs. Vishing: Key Differences

Smishing, phishing, and vishing are three variants of the same crime: social engineering. In each case, an attacker impersonates a trusted organization or person to trick a victim into handing over credentials, money, or personal information. The difference between them is simply the channel the attacker uses. Phishing arrives by email, smishing arrives by SMS text message, and vishing arrives by voice call.

That one-sentence distinction is worth committing to memory: phishing is fraud by email, smishing is fraud by text message, and vishing is fraud by phone call, and all three are forms of social engineering that manipulate the victim rather than the technology.

Because the terms get used loosely in news coverage and security training, this article defines each one precisely, compares how they work, and explains what to do when you encounter them. It draws on the terminology used by the Federal Trade Commission (FTC), the Cybersecurity and Infrastructure Security Agency (CISA), and the FBI's Internet Crime Complaint Center (IC3), the three federal bodies most often cited on these threats.

Phishing: Fraud by Email

Phishing is the oldest and broadest of the three terms. In a phishing attack, a criminal sends an email designed to look like it comes from a legitimate source, such as a bank, an employer, a delivery company, or a government agency. The email typically contains a link to a fake website that harvests login credentials, an attachment that installs malware, or a request to reply with sensitive information.

Common phishing signals include:

• A sender address that almost, but not quite, matches the real organization's domain
• Urgent language pressuring you to act immediately ("your account will be suspended")
• Generic greetings like "Dear Customer" instead of your name
• Links whose visible text does not match the actual destination URL
• Unexpected attachments, especially compressed files or documents requesting you to enable macros

Phishing also has targeted variants. Spear phishing aims at a specific individual using personal details, and whaling targets executives or other high-value individuals. Business email compromise (BEC), which the FBI IC3 tracks as one of the costliest categories of internet crime, often begins with a phishing or spear phishing message.

Smishing: Fraud by Text Message

Smishing is phishing conducted over SMS. The word is a blend of "SMS" and "phishing." A smishing text impersonates a trusted sender, such as a bank, a package carrier, a toll authority, or even a family member, and pushes the recipient to tap a link, reply with information, or call a number controlled by the attacker.

For a full definitional treatment, see our companion glossary entry on what smishing is and how SMS phishing works. The short version: smishing succeeds because text messages feel personal and urgent, people tend to read them quickly, and a phone screen hides many of the cues (full URLs, sender domains, hover previews) that help people spot email phishing.

Typical smishing lures include:

• Fake package delivery notices asking you to "confirm your address" via a link
• Fake bank fraud alerts asking you to verify a transaction
• Fake toll or fee notices claiming a small unpaid balance
• "Wrong number" texts that open a friendly conversation and later pivot to an investment or romance scam
• Impersonation of the recipient's own employer or IT department

The FTC advises consumers to report scam texts by forwarding them to 7726 (which spells SPAM), the industry short code that wireless carriers use to collect junk-message reports, and to file complaints at ReportFraud.ftc.gov.

Vishing: Fraud by Voice Call

Vishing is voice phishing: social engineering conducted over a phone call. The attacker may be a live person or a recorded message, and caller ID is frequently spoofed so the call appears to come from a bank, a government agency, or a local number.

Classic vishing scenarios include:

1. A caller claiming to be from your bank's fraud department who asks you to "verify" your account number, PIN, or a one-time passcode
2. A recorded message claiming to be the IRS or Social Security Administration threatening arrest or benefit suspension
3. Tech support scams claiming your computer is infected and asking for remote access
4. Calls impersonating a grandchild or other relative in an emergency who needs money wired immediately

Vishing is often combined with the other channels. A common multi-stage attack sends a smishing text ("Suspicious charge detected, call this number"), and the vishing call that follows does the actual harvesting. Security researchers sometimes call this callback phishing. The lesson is that the three categories are not rivals; they are interchangeable and stackable tools in the same criminal playbook.

Side-by-Side Comparison

Why the Channel Matters

If all three are the same crime, why bother distinguishing them? Three practical reasons.

Defenses differ by channel. Email systems have mature filtering, sender authentication standards (SPF, DKIM, DMARC), and attachment sandboxing. SMS has far fewer built-in protections, which is part of why smishing has grown so quickly. Voice defenses rely on caller ID authentication frameworks such as STIR/SHAKEN, which the FCC has required carriers to implement to combat spoofed robocalls.

Reporting paths differ. Scam emails can be reported to the impersonated company and the FTC. Scam texts should be forwarded to 7726 and reported to the FTC, and significant losses should go to the FBI IC3 at ic3.gov. Scam calls can additionally be reported to the FCC at fcc.gov/complaints.

Training has to be channel-specific. Employees who ace an email phishing simulation can still fail a smishing or vishing test, because the cues are different. Organizations that use SMS legitimately have an extra duty here: their messaging practices should be consistent and predictable so recipients can tell real messages from fakes. A good starting point is an internal SMS compliance checklist that standardizes sender IDs, link domains, and opt-in language.

What Legitimate Senders Can Learn

Organizations that text their communities, such as nonprofits, healthcare providers, schools, and government agencies, are indirect victims of smishing too, because every scam text erodes trust in the channel. Legitimate senders can protect their audiences by:

• Registering their messaging traffic properly (10DLC registration for business texting in the US) so carriers can verify the sender
• Using one consistent, branded link domain rather than random shorteners
• Never asking for passwords, one-time codes, Social Security numbers, or payment details by text
• Telling recipients at opt-in exactly what kinds of messages to expect and from what number
• Following the CTIA Messaging Principles and Best Practices, the wireless industry's baseline guidelines for consumer messaging

Platforms built for regulated senders make this easier. FRANSiS, for example, is designed around consent-based, verified organizational texting, with security practices documented here, so that community members learn to recognize and trust the organization's real number.

How to Respond to Each Attack Type

Whatever the channel, the safe response pattern is the same. Do not act on the message itself. Instead:

1. Stop. Do not click, reply, call back, or open attachments.
2. Verify independently. Contact the organization through a number or website you find yourself, not one provided in the message.
3. Report. Forward scam texts to 7726, report fraud at ReportFraud.ftc.gov, file with the FBI IC3 at ic3.gov if money or sensitive data was lost, and report unwanted calls at fcc.gov/complaints.
4. Contain. If you shared credentials, change them immediately and enable multi-factor authentication. If you shared financial details, contact your bank and consider a credit freeze.

Frequently Asked Questions

Is smishing a type of phishing?

Yes. Smishing is phishing carried out over SMS text messages instead of email. Security agencies such as CISA treat phishing as the umbrella category of deceptive social engineering messages, with smishing (SMS) and vishing (voice) as channel-specific variants of the same underlying attack.

Which is more dangerous, smishing or phishing?

Neither is inherently more dangerous; risk depends on the target and context. Smishing benefits from the trust and urgency people attach to text messages and from the limited security tooling on SMS, while email phishing supports more complex payloads such as malware attachments. Treat both channels with the same skepticism.

What does vishing look like in practice?

Vishing usually appears as a call from a spoofed number claiming to be a bank fraud department, a government agency, or tech support. The caller pressures you to reveal account details, read back a one-time passcode, buy gift cards, or grant remote access to your device. Legitimate institutions do not ask for full passwords or one-time codes by phone.

Where do I report smishing, phishing, and vishing?

Forward scam texts to 7726 (SPAM), which alerts your wireless carrier. Report all three attack types to the FTC at ReportFraud.ftc.gov. If you lost money or sensitive information, file a complaint with the FBI Internet Crime Complaint Center at ic3.gov. Unwanted or spoofed calls can also be reported to the FCC at fcc.gov/complaints.

How can organizations keep their real texts from looking like smishing?

Register your messaging with carriers, text only people who opted in, use a consistent sender number and branded links, never request sensitive data by SMS, and follow the CTIA Messaging Principles and Best Practices. Predictable, consent-based texting teaches your audience what your real messages look like.

Protect Your Community's Trust in Texting

FRANSiS helps nonprofits, healthcare organizations, schools, and government agencies run verified, consent-based SMS programs that recipients can trust, with an AI Powered Helper to manage two-way conversations at scale. Contact us to see how trustworthy texting is done.