# Phishing vs smishing vs vishing: what's the difference?

URL: https://iblockspam.com/blog/phishing-vs-smishing-vs-vishing
Last updated: 2026-10-12
Published: 2026-10-12
Topic: Email security basics
Author: iBlockSpam Team

> Phishing, smishing and vishing compared: email vs text vs voice scams, official definitions, examples, how attackers chain them, and where to report each one.

## Short answer

Phishing, smishing and vishing are the same scam over different channels. Phishing usually means email, smishing uses SMS or MMS text messages, and vishing uses phone calls or voice messages. All three impersonate someone you trust to get passwords, codes, money or remote access. Attackers often chain them, such as an email that tells you to call a number.

The names sound like jargon, but the distinction is simple: they're the same con delivered through different channels. Knowing the channel matters because each one fakes the sender differently, gets past different defenses, and is reported in a different place. This guide compares phishing, smishing and vishing side by side, shows how attackers chain them, and gives one set of habits that works for all three.

## What is the difference between phishing, smishing and vishing?

The difference is the channel. **Phishing** is the umbrella term for impersonation scams and, used on its own, usually means email. **Smishing** is phishing by SMS or MMS text message. **Vishing** is phishing by voice: live calls, voicemails or voice memos.

The official definitions line up:

- CISA describes phishing as attacks that "use email or malicious websites to solicit personal information by posing as a trustworthy organization" ([CISA](https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks)).
- CISA calls smishing "a form of social engineering that exploits SMS, or text, messages," and vishing "the social engineering approach that leverages voice communication."
- The FBI defines smishing as "the malicious targeting of individuals using Short Message Service (SMS) or Multimedia Message Service (MMS) text messaging," and notes that vishing "may incorporate AI-generated voices" ([FBI IC3, May 2025](https://www.ic3.gov/PSA/2025/PSA250515)).

The FBI's crime statistics don't even separate them. Its [2025 IC3 report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) defines phishing/spoofing as "unsolicited email, text messages, and telephone calls purportedly from a legitimate company." For the bigger picture, start with [what phishing is](https://iblockspam.com/blog/what-is-phishing).

## Phishing vs smishing vs vishing: comparison table

This table compares the three channels on the points that change how you defend against them.

| | Phishing (email) | Smishing (text) | Vishing (voice) |
|---|---|---|---|
| Channel | Email | SMS, MMS, often messaging apps too | Phone calls, voicemail, voice memos |
| How the sender is faked | Display name, lookalike domain or spoofed domain | Unknown number, short code or a spoofed sender name | Spoofed caller ID, sometimes an AI-cloned voice |
| Typical lures | Password expiry, invoice, shared document, boss request | Missed delivery, bank alert, toll or fine, prize | Bank fraud team, IT help desk, government agency, executive |
| What they want | Sign-in on a fake page, attachment opened, payment | Tap a link, enter card or login details | Codes, passwords, payment, remote access |
| Business defenses that see it | Email filtering, SPF/DKIM/DMARC, link and attachment scanning | Usually few on personal phones | Almost none; process controls do the work |
| Where to report (US) | Your mail app's report button, reportphishing@apwg.org, ReportFraud.ftc.gov | Forward to 7726, ReportFraud.ftc.gov | ReportFraud.ftc.gov, or DoNotCall.gov if you lost nothing |

The fifth row is the one that matters for a business. Email is the channel where you can put technical controls in the path. Texts and calls usually bypass them, so they rely on people and process.

## What is smishing?

Smishing is phishing sent as a text message. The message is short, carries a link or a phone number, and creates a small, believable problem: a parcel that can't be delivered, a card that's been frozen, an unpaid toll. The US Postal Inspection Service calls it "a form of phishing that involves a text message or phone number" ([USPIS](https://www.uspis.gov/news/scam-article/smishing-package-tracking-text-scams)).

An example smishing text (not a real message):

```text
USPS: Your parcel is held at our facility due to an incomplete
address. Update within 24h to avoid return: https://usps-redeliver.example/t/8k2
```

Smishing works for three reasons. The phone is personal, so it feels more trusted. The screen is small: CISA's joint guidance notes "it can be difficult for a user to detect malicious uniform resource locators (URLs) on these small platforms." And texts to personal phones don't pass through company mail filters. The FTC's [spam text guidance](https://consumer.ftc.gov/articles/how-recognize-and-report-spam-text-messages) lists the common stories: "free prizes, gift cards, or coupons," "suspicious activity on your account," and "a package delivery notification."

Our guide to [fake delivery notifications](https://iblockspam.com/blog/fake-delivery-notification-emails) covers the email versions of the same lure.

## What is vishing?

Vishing is phishing carried out by voice, live or recorded. The caller poses as your bank's fraud team, your IT help desk, a government agency or a senior colleague, and uses the conversation to get a one-time code, a password, a payment or remote access to your computer.

An example vishing script (not a real call):

```text
"Hi, this is Dan from the IT service desk. We're seeing sign-in
alerts on your account. I'm going to send you a code to confirm
it's you. Can you read it back to me?"
```

Two things make vishing effective. Caller ID proves nothing: the FTC says "scammers can make any name or number show up on your caller ID. That's called spoofing" ([FTC](https://consumer.ftc.gov/articles/phone-scams)). The CISA-led guidance adds that attackers use internet calling to "easily spoof caller identification." And voices can now be faked. The FBI warns that cloned voices "can sound nearly identical" to a known contact, and says to "never provide a two-factor code to anyone over email, SMS/MMS text message or encrypted messaging application" ([FBI IC3](https://www.ic3.gov/PSA/2025/PSA250515)).

Our guide to [AI voice cloning and deepfake BEC](https://iblockspam.com/blog/ai-voice-cloning-deepfake-bec) covers the executive-impersonation version.

## How do attackers combine email, texts and calls?

Attackers often combine channels, because each step makes the next one more believable and moves you away from the channel that's best protected. Common chains:

- **Email, then call.** [Callback phishing](https://iblockspam.com/blog/callback-phishing-phone-scam-emails) sends a fake invoice with no link at all, just a number to call. The scam happens on the phone, where no filter can see it.
- **Email, then phone screen.** [QR code phishing](https://iblockspam.com/blog/qr-code-phishing-quishing) puts the link in an image, so you open it on a phone instead of a protected work computer.
- **Fake voicemail email.** [Voicemail phishing emails](https://iblockspam.com/blog/voicemail-phishing-emails) borrow the language of phone calls to deliver a fake sign-in page.
- **Text, then call, then sign-in.** A text warns of a problem, a "support agent" calls, and you're talked into approving an MFA prompt or reading out a code.
- **Chat apps.** The CISA-led guidance lists Teams, Slack, Signal, WhatsApp and similar platforms as routes for the same lures. See [Microsoft Teams phishing](https://iblockspam.com/blog/microsoft-teams-phishing-external-access).

The lesson is that a check in one channel ("the email looked fine") says nothing about the next.

## How do you spot each one?

You spot all three by the same pattern: an unexpected contact, a reason to act now, and a request for something valuable. Channel-specific clues help:

| Channel | Warning signs |
|---|---|
| Email | Display name doesn't match the address, unexpected attachment, link text and real link differ, reply-to goes elsewhere |
| Text | Unknown number, shortened or odd link, deadline in hours, asks you to "update" or "confirm" details |
| Voice | Caller asks for a code, password or remote access, pushes you to stay on the line, payment by gift card, crypto or wire |

The FTC warns: "Don't pay someone who insists that you can only pay with a gift card, cryptocurrency" or similar methods ([FTC](https://consumer.ftc.gov/articles/phone-scams)). For email in depth, see [how to spot a phishing email](https://iblockspam.com/blog/how-to-spot-a-phishing-email).

## How do you report phishing, smishing and vishing?

You report each one through the channel's own tools first, then to the authorities. In the US, combine your own tools with the FTC's guidance:

1. **Phishing email:** use your mail app's report button, forward the message to reportphishing@apwg.org, and report it at ReportFraud.ftc.gov ([FTC](https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams)).
2. **Smishing text:** forward it to 7726 (SPAM), use your app's report-junk option, and report it at ReportFraud.ftc.gov.
3. **Vishing call:** hang up, then report it at ReportFraud.ftc.gov if you lost money, or at DoNotCall.gov if you only want to report the call ([FTC](https://consumer.ftc.gov/articles/phone-scams)).
4. **If you lost money:** contact your bank or payment provider at once and ask for a reversal, then report to the FBI's IC3.
5. **At work:** tell IT or security as well, even if you didn't click. One report can protect the colleagues who got the same message.

Our [phishing reporting guide](https://iblockspam.com/blog/report-phishing-email) covers Outlook, Gmail, Apple Mail and the UK's reporting addresses.

## How can a business protect staff from all three?

A business protects staff from all three channels with a verification habit that doesn't depend on the channel, plus strong controls where it has them. In priority order:

1. **Set a call-back rule.** Any request for money, bank-detail changes, codes or access is confirmed on a number from your own records, never one supplied in the message or call.
2. **Never share one-time codes.** Make it policy that IT will never ask for a code or password, and say so often.
3. **Use phishing-resistant MFA** for admins and finance staff. The CISA-led guidance recommends FIDO or PKI-based MFA, and number matching where push prompts are still used.
4. **Protect the help desk.** Require identity checks before password or MFA resets, since vishing often targets support staff.
5. **Filter the email channel well.** It's where most chains start, and where you can see the lure before a person does. Publish DMARC at `p=reject` so your own domain can't be used in the first message.
6. **Train for every channel.** Include texts and calls in awareness training, not just email. See our [security awareness training guide](https://iblockspam.com/blog/email-security-awareness-training-small-business).

## Next steps

- Write down your call-back rule and share it with everyone who handles payments or account resets.
- Check whether criminals can send email as your domain with the free [DMARC Checker](https://iblockspam.com/tools/dmarc-checker).
- Inspect a suspicious email's real sender with the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer), which runs in your browser.
- If phishing emails are still reaching inboxes, iBlockSpam filters spam, phishing and malware before delivery, with personal quarantine for every user. See [how it works](https://iblockspam.com/how-it-works).

## Frequently asked questions

### What does smishing stand for?

Smishing combines SMS and phishing. It means phishing by text message. The FBI defines it as the malicious targeting of individuals using SMS or MMS text messaging. The same name is often used for scams sent through messaging apps, although those apps aren't technically SMS.

### What does vishing stand for?

Vishing is short for voice phishing: scams carried out by phone call, voicemail or voice memo. CISA describes it as the social engineering approach that leverages voice communication. Modern vishing can use spoofed caller ID and AI-generated voices that sound like someone you know.

### Is smishing more dangerous than email phishing?

Not inherently, but it's often less protected. Work email passes through filters that check links, attachments and sender authentication. A text to a personal phone usually doesn't, and CISA notes that malicious links are harder to spot on small screens. The safest assumption is that every channel needs the same verification habit.

### Can a phone number on caller ID be faked?

Yes. The FTC says scammers can make any name or number show up on your caller ID, which is called spoofing. A call that appears to come from your bank, a government agency or your own company proves nothing. Hang up and call back on a number you look up yourself.

### Where do I report a smishing text in the US?

Copy or forward the text to 7726, which spells SPAM, and use your messaging app's report-junk option. Then report it to the FTC at ReportFraud.ftc.gov. If the text impersonates the Postal Service, the US Postal Inspection Service also takes reports. Don't tap any link in the message while you do this.

## Sources

- [CISA: Avoiding Social Engineering and Phishing Attacks](https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks)
- [FBI IC3 PSA: Senior US Officials Impersonated in Malicious Messaging Campaign (May 2025)](https://www.ic3.gov/PSA/2025/PSA250515)
- [CISA, NSA, FBI, MS-ISAC: Phishing Guidance: Stopping the Attack Cycle at Phase One (October 2023, PDF)](https://www.cisa.gov/sites/default/files/2023-10/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf)
- [FTC: How to Recognize and Report Spam Text Messages](https://consumer.ftc.gov/articles/how-recognize-and-report-spam-text-messages)
- [FTC: Phone Scams](https://consumer.ftc.gov/articles/phone-scams)
- [FTC: How to Recognize and Avoid Phishing Scams](https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams)
- [U.S. Postal Inspection Service: Smishing](https://www.uspis.gov/news/scam-article/smishing-package-tracking-text-scams)
- [FBI Internet Crime Complaint Center: 2025 IC3 Annual Report (PDF)](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/phishing-vs-smishing-vs-vishing (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt