Two names for an old trick
Smishing is phishing by SMS or other text messaging, and vishing is phishing by voice call. Both aim to get you to reveal information, click something, send money or give a criminal access to a device. The tactic is the same as in email scams, but the delivery changes how it feels and how you respond.
Why text and phone scams feel different
They arrive on a personal device. A text lands next to messages from family and friends. Because phones feel personal, people may trust a message there more than one in a spam folder.
There is less to inspect. On a small screen, you often see only a short message and a link. The sender field may be a number or a name, and the full web address can be hard to read.
They invite speed. A text is brief and tempts a tap. A phone call creates real-time pressure, since a live voice expects an answer now.
Filtering is weaker. Email systems often filter many phishing attempts. Text and phone filtering exists but is typically less thorough, and varies by carrier and country.
Spoofing is common. The number or sender name shown can be faked. A message can appear in the same thread as genuine texts from a real organization, and a call can seem to come from a bank, a government office or even a local number.
Typical smishing messages
- Delivery problems. A parcel is held and you must pay a small fee or confirm an address through a link.
- Bank or account alerts. Suspicious activity, a locked account or a pending payment that you need to “verify.”
- Unpaid fees. Road tolls, fines, taxes or bills with a deadline.
- Prizes and refunds. A refund is waiting, or you have won something.
- “Wrong number” openers. A friendly message that seems sent by mistake, which is meant to start a conversation. These often lead into romance or investment scams.
- Family emergency. A message from a “new number” claiming to be a relative who needs urgent money. This is an example of the impersonation scams covered elsewhere in this cluster.
- Verification codes. A request to send back the code you just received. That code is usually the key to your account, and nobody legitimate needs you to share it.
The link in these messages often leads to a convincing fake page that collects logins or card details, or installs something unwanted.
Typical vishing calls
- Bank fraud departments. The caller says your account is under attack and you must move money to a “safe account” or read out a code. Real banks do not ask for this.
- Government or law enforcement. Threats of arrest, deportation or penalties unless you pay immediately, often by gift cards or transfer.
- Technical support. Claims that your device is infected, followed by a request to install remote-access software.
- Utility or service providers. Warnings of disconnection unless payment is made right away.
- Robocalls and recordings. Automated messages that ask you to press a key, which can lead to a live scammer.
- Voice cloning. Some fraudsters use generative AI to imitate a voice from a short sample. Because this is possible, a familiar voice alone should not be the final test in an emergency money request.
What they usually ask for
Across both channels, requests tend to fall into a few categories: personal details, passwords or one-time codes; payment by methods that are hard to reverse; installing an app or giving remote access; and tapping a link. The more a request involves secrecy, urgency or unusual payment, the more suspicious it should be.
Safer habits
- Do not tap links in unexpected texts. Instead, open the organization’s app or type its address into your browser yourself.
- Never share one-time codes. Treat them like passwords. This is also why two-factor authentication works best when you stay alert to who is asking for the code.
- Hang up and call back. If a caller claims to be from your bank or another organization, end the call and phone the number printed on your card, statement or the official website. If possible, use a different phone or wait a few minutes first, since scammers can sometimes keep a line open.
- Be wary of caller ID and sender names. They show information, not proof.
- Do not be rushed. Real organizations allow time to verify.
- Be careful with apps and permissions. Do not install software at a stranger’s request, and review app permissions if you think you may have installed something unwanted.
- Do not reply. Even replying “STOP” to an unknown sender can confirm your number is active. Delete, block and report instead.
- Report them. Many carriers accept forwarded scam texts to a reporting number, and phones often have a “report junk” option. Details vary by country and carrier.
Special care for family members
Older relatives and anyone who is not used to scam tactics can find phone pressure particularly hard to resist. Agreeing a simple family routine, such as hanging up and calling back on a known number for any money request, helps. Our article on helping older relatives stay safe online goes into this further.
If you replied or clicked
If you gave out a password, change it at once, and change any other account where you used it. Contact your bank or card provider if payment details were shared. If you installed something or allowed remote access, disconnect the device from the internet and seek reliable help. Further general steps are described in the article on recovering after a scam. A quick report to the relevant bank, carrier or authority helps limit harm and may protect others.