Phishing, Smishing & Vishing: How to Spot Digital Scams

What Do Phishing, Smishing, and Vishing Actually Mean?

All three words describe the same basic move: a scammer impersonates someone you trust, a bank, a government agency, your employer, a delivery company, and tries to rush you into clicking a link, sharing sensitive information, or sending money before you've had time to think it through. The only real difference between the three is the delivery channel.

Phishing: The Email Version

Phishing is the original term and is generally used for scams that arrive by email, a fake bank alert, a fake invoice, a fake “your package couldn't be delivered” notice. It's also often used as the umbrella term for the whole category, the way “Kleenex” gets used for tissues generally.

Smishing: The Text Message Version

Smishing (a mashup of “SMS” and “phishing”) is the same scam delivered as a text message, usually with a link to tap or a number to call back.

Vishing: The Phone Call Version

Vishing (“voice” plus “phishing”) is the same scam delivered as a live phone call, a voicemail, or a robocall, sometimes with a real human on the other end, sometimes with a recorded or even AI-generated voice.

Scammers frequently combine channels: a text tells you to call a number, and the person who answers is running a vishing script. The channel is just packaging, the con inside is always some version of act now, don't verify independently, and hand over money or information.

How Does Email Phishing Work?

Email phishing remains one of the most common ways criminals get a foothold into someone's finances or a company's systems. Verizon's 2026 Data Breach Investigations Report found that roughly 62% of confirmed data breaches involve some human element, and phishing alone accounts for about 16% of initial access into breached systems.

The most common everyday version is a fake login page: an email that looks like it's from your bank, PayPal, or Amazon, warning that your account has been “limited” or flagged for “suspicious activity.” The link goes to a page that looks nearly identical to the real site, but the web address is subtly off, an extra word, a swapped letter, a different domain ending. Type in your username and password there, and the scammer now has them. A close cousin is the fake invoice or wire fraud email: a message that looks like a bill from a vendor you actually use, asking you to update payment details or send a wire transfer to a “new” account.

What Is Business Email Compromise (BEC)?

Business email compromise, or BEC, is a more targeted and far more expensive version of email phishing, sometimes called “spear phishing” because it's aimed at a specific person rather than blasted to thousands of inboxes at once. A scammer researches a company, then hacks or spoofs the email account of an executive, a vendor, or a title/escrow company, and sends an urgent request, usually to someone in accounting or HR, to wire money, change a payroll bank account, or buy gift cards for a “client gift.” The email looks like it came from the boss because, in a real sense, it did: the account was compromised, or the display name and domain were spoofed to look nearly identical.

BEC is not a small-dollar problem: the FBI's Internet Crime Complaint Center (IC3) reported more than $3 billion in confirmed BEC losses in 2025 across roughly 24,700 complaints, an average loss well over $120,000 per complaint. If you handle payments or vendor relationships for a business, confirming any request to change banking details or send an urgent wire with a known, previously verified phone number is the single control that stops most BEC losses.

What Other Smishing Scams Should You Know About?

If a scam text about a missed package or an unpaid toll landed in your phone recently, you're not imagining a trend, we cover that specific format in detail in our dedicated article on fake delivery and toll text scams. Here are three other smishing formats that use the exact same playbook.

Fake bank fraud alert texts. You get a text that appears to come from your bank's real short code, warning of a suspicious charge and asking you to reply or tap a link to “verify” the transaction. The link leads to a fake login page designed to capture your online banking credentials, or the reply triggers a follow-up call from a “fraud department” that is itself part of the scam. Real banks do not ask you to send your password, full card number, or one-time verification code by text.

Fake prize, lottery, and gift card texts. A message claims you've won a gift card or sweepstakes prize and just need to “claim” it by clicking a link and entering personal or payment information. There is no prize, the goal is either to harvest your data or collect a small “processing fee.”

Fake job offer texts. An unsolicited text offers a high-paying, flexible remote job, sometimes referencing a resume you never posted. The “employer” then asks for personal information for “onboarding,” asks you to buy your own equipment and wait for reimbursement, or asks you to deposit and forward a check, a classic check fraud setup layered on top of the phishing hook.

What Other Vishing Scams Should You Know About?

If you've heard about scammers cloning a loved one's voice to fake an emergency, that's a real and fast-growing threat we cover in detail in our dedicated article on AI voice cloning scams. The vishing formats below don't require any AI at all, just a phone, a script, and your instinct to be helpful or afraid.

Fake tech support calls. You get a call, or a pop-up warns that your device is infected and lists a number to call. The “technician” asks for remote access to your computer, runs a fake scan that always finds a problem, then charges for unnecessary “repairs”, or uses that access to steal financial information directly. Tech support scams have cost Americans hundreds of millions of dollars, with a typical reported loss around $500 per victim. A genuine security alert from Microsoft, Apple, or your antivirus software will never ask you to call a phone number.

Fake IRS and Social Security Administration calls. A caller claims to be from the IRS, threatens immediate arrest over unpaid back taxes, and demands payment right away, often by gift card, wire transfer, or cryptocurrency. A close cousin claims to be from the Social Security Administration, warning that your Social Security number has been “suspended” and that you must “verify” it or move your money to a “safe” account. The FTC received more than 330,000 government impersonation complaints in 2025 alone, a 25% jump over the prior year. The real IRS never demands immediate payment or threatens arrest by phone, and the real SSA never suspends Social Security numbers or asks you to move money to protect it. Hang up and call the agency back using a number you look up yourself.

Fake bank fraud department calls. A caller says they're from your bank's fraud team and asks you to “verify” your identity by reading back a one-time passcode just texted to you, that passcode is actually the code your bank sent to authorize a transaction the scammer is making in real time. No legitimate bank employee will ever ask for it.

Spoofed caller ID. Across every format above, scammers routinely “spoof” the number on your screen so it displays your bank's real line, the IRS's real number, or even a local number matching your own area code. A familiar-looking caller ID is not proof of who's calling.

Phishing vs. Smishing vs. Vishing at a Glance

The table below summarizes the channel, the most common examples, and the single biggest red flag for each.

The Universal Mental Model: How to Spot Any Digital Scam

You don't need to memorize every format above. Nearly all of them share the same five ingredients. If a message or call hits two or more, treat it as a scam until proven otherwise.

• Unsolicited contact. You didn't initiate it, the email, text, or call came out of nowhere.
• Manufactured urgency or fear. “Act now,” “your account will be closed,” “a warrant is being issued.” Urgency is designed to shut down your critical thinking.
• A link or phone number provided inside the message itself. Legitimate organizations expect you to already know how to reach them.
• A request for sensitive information: your Social Security number, password, bank login, or a one-time 2FA code that was just sent to you.
• An unusual payment request: gift cards, wire transfers, cryptocurrency, or a payment app like Zelle or Venmo sent to a stranger.

The golden rule that defeats all three formats at once: if you're contacted out of the blue, don't use any link, number, or QR code provided in that message. Independently look up the organization's phone number or website, from the back of your card, a prior statement, or a search you trust, and contact them yourself.

What Technical Habits Actually Protect You?

A few small habits close most of the gap between “I almost fell for it” and “I didn't.”

• Hover before you click. On a computer, hover your mouse over a link (without clicking) to see the real destination URL. On a phone, press and hold a link to preview it. If it doesn't match the company's real website, stop.
• Check the sender's actual email address, not just the display name. A message can say “Wells Fargo Security” while the underlying address is something unrelated, tap or click the sender's name to reveal it.
• Never share a one-time passcode with anyone who calls or texts you. A 2FA code is only ever meant to go into the app or website you're logging into yourself.
• Turn on your phone's built-in spam and scam call filtering, and forward scam texts to 7726 (SPAM) where your carrier supports it.
• Turn on your email provider's spam and phishing filters, and don't disable warning banners that flag messages from external senders.
• When in doubt, pause. Legitimate deadlines survive a five-minute phone call to a number you looked up yourself.

Frequently Asked Questions