Phishing, Smishing, and Vishing: Spotting Scams Across Every Channel

Three Channels, One Goal: Your Information

Scammers are opportunists. They use whichever communication channel gives them the best shot at catching you off guard — and that means email, text messages, and phone calls are all in play. The three primary attack types have distinct names that reflect their delivery method:

While the names differ, the underlying goal is identical: trick you into revealing sensitive information, clicking a malicious link, or transferring money. Understanding what each looks like in practice makes them far easier to recognize — and resist. If you're already aware that everyday digital habits can create vulnerabilities, recognizing these scam channels is a natural next step.

Phishing: The Email Threat That Never Went Away

Phishing arrives in your inbox disguised as a trusted sender — a bank, a government agency, a shipping company, or even a colleague. The message typically creates urgency: your account is locked, a package couldn't be delivered, a payment failed. The goal is to get you to click a link or open an attachment before you stop to think.

Red flags to watch for:

• The sender's email address doesn't match the organization's official domain (e.g., support@amaz0n-secure.net instead of amazon.com)
• Generic greetings like "Dear Customer" rather than your name
• Urgent or threatening language demanding immediate action
• Links that display one URL but redirect to another when you hover over them
• Attachments you weren't expecting, especially .zip, .exe, or .docm files

Spear phishing — a more targeted version — uses personal details gathered from social media or data breaches to make the message feel legitimate. These are harder to spot, which is why building consistent safety habits matters more than any single alert.

Smishing and Vishing: When Scams Go Mobile

Smishing (SMS phishing) exploits the casual trust most people extend to text messages. Common examples include fake package delivery notifications, bank fraud alerts, and bogus two-factor authentication requests. Because texts feel immediate and personal, many people respond before scrutinizing the source.

Vishing (voice phishing) involves a live or automated call. Callers may impersonate the IRS, Social Security Administration, Medicare, tech support, or a bank's fraud department. They often already know partial details about you — your name, zip code, or the last four digits of your account — making the call feel credible.

Smishing red flags:

• Short links (like bit.ly) from unknown numbers
• Requests to confirm or update account info via a link
• Messages claiming a prize or reward requiring immediate action

Vishing red flags:

• Unsolicited calls demanding immediate payment — especially gift cards or wire transfers
• Callers who refuse to let you hang up and call back on an official number
• Pressure tactics paired with threats of arrest, account closure, or legal action

Travelers are especially exposed: using unfamiliar networks abroad can increase your vulnerability. See our guidance on protecting your devices and data while traveling for channel-specific precautions on the road.

What to Do When You Suspect a Scam

Recognition is only half the battle. Having a clear response plan keeps a moment of doubt from turning into a serious compromise.

1. Don't engage. Hang up, close the message, or delete the email without clicking anything.
2. Verify independently. If the message claims to be from your bank, call the number on the back of your card — not any number provided in the message.
3. Report it. Forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org. Report smishing and vishing to the FTC at reportfraud.ftc.gov.
4. Check your accounts. If you clicked a link or provided any information, monitor your financial accounts and consider a credit freeze. Scams across these channels frequently lead to identity theft or account takeover — two related but distinct harms worth understanding.