What Is The Difference Between Phishing, Smishing & Vishing? 

Promotion

According to recent statistics, an internet user falls victim to cybercrime every 37 seconds. And since we’re spending more of our lives online, the problem only looks set to worsen. From 2020 to 2021, for example, cybercrime increased by 40 percent. This is likely due to more people using personal electronic devices for work and being online more during the COVID-19 lockdowns. 

Online scammers carry out identity fraud in various ways. From scam calls to fraudulent emails, and everything in between. Once they have your sensitive data, they can then steal your money, take out loans in your name, sell your credentials on the Dark Web, and impersonate you to commit crimes in other ways. 

With the increased threat of cybercrime, we are constantly being reminded to stay vigilant and aware of how fraudsters operate. The more we understand scams, the better equipped we are to avoid becoming victims. 

When being warned about cybercrime, you may have heard the terms "phishing", "smashing", and “vishing”. They sound similar, but you may be wondering whether they mean the same thing. Keep reading to find out. 

Are Phishing, Smishing and Vishing the same? 

Phishing, smishing and vishing are all types of identity fraud whereby scammers contact you in an attempt to steal your personal details or financial information. The fraudster pretends to be a trusted company or organisation, encouraging the recipient to voluntarily hand over confidential data or follow a link that installs malware like viruses, spyware, ransomware or adware on their device. 

The way you are targeted differs depending on which method the scammer uses. Phishing attacks are made over email, smishing is carried out via text messages, and vishing takes place over the phone. 

In this article, we’ll explain these terms in more detail, give tips on how to protect yourself against cyber attacks and advise on what to do if you do become a victim. 

What is Phishing? 

Phishing is a method of cyber fraud that’s carried out over email. The email will usually contain a malicious link that takes the recipient to what appears to be a legitimate website asking them to input sensitive data like usernames and passwords or financial information like bank details. This data will then be sent directly to the fraudsters, with the victim only becoming aware of what’s happened once it is too late. 

Often, fraudsters will duplicate the website of an official department or trusted brand to trick — or scare — people into thinking it is the real thing. The scammer may claim that the recipient’s account is locked and ask them to re-enter their login details on the fake site. 

Phishing attacks are usually designed with one or more of the following goals in mind: 

  • To inject malware 
  • To gain access to confidential information 
  • To receive money via a bank transfer or similar 

Cybercriminals are known for sending generic emails to a vast amount of people in the hope that some will be fooled. In marketing, this is known as the “Spray and Pray” method. 

What is Smishing? 

Smishing — or SMS phishing — is done over text or messaging apps and, again, will usually contain a malicious link from a company that seems legitimate. Smishing messages that pose as delivery companies, government bodies and banks are most common because these organisations often communicate with their customers via text message. When the fraudulent link is clicked on, victims will be taken to a form that is designed to either steal their data or download malware to their devices. Often, the link will be a shortened URL (which is harder to recognise as fake) urging recipients to take immediate action in the form of paying a postage fee for a parcel which is to be delivered, claiming a prize within a specific time period or verifying their identity because their financial details have been compromised.  

It is the urgency of these messages that makes these scam messages so effective. Additionally, they can be more successful than phishing and vishing scams because text messages feel more informal and personal (and therefore more trustworthy). Plus, mobile phones don’t tend to be as well protected as computers. 

What is Vishing? 

Phishing that’s done over the telephone is called vishing, because it is “voice” phishing.  

Again, the scammer will pretend to be from a legitimate organisation urging immediate action in order to acquire personal data from individuals, such as their bank details or login information, to gain access to their accounts. 

In the past, fraudulent phone calls were relatively easy to spot as they would be from an unknown number, and the caller would ask for bank details or money right away. Today, fraudsters are using increasingly sophisticated techniques to obtain the information they want. For example, a sophisticated phishing attack may start with a scam email and follow up with a vishing call from a fake caller ID to make the scene appear more convincing. Some may even record the call and prompt you to say the word “Yes” so they can use the recording to impersonate you on another phone call to authorise payments or access your bank accounts. 

How to Protect Yourself from Cyber Attacks 

As well as trying to trick individuals with these scams, cybercriminals target businesses too. This means everyone should take measures to protect themselves from cyber fraud. 

As mentioned, being aware of the techniques scammers use can make you less likely to fall victim. With that in mind, some of the signs to look out for include:  

  • A threatening or urgent tone -  An email, text message or phone call that urges you to take immediate action. 
  • Unexpected messages or phone calls - Especially if they sound too good to be true or try to intimidate you. 
  • An unknown sender or caller - If you don’t recognise the brand or organisation that’s contacted you, it may be a scam. 
  • A request for personal or financial information - For example, bank account details, credit card numbers or login details. 
  • Links - These may look like they come from a legitimate company, but they could be malicious links, especially if they look strange (for example, words broken up with dots or ending with something other than .com, .co.uk or .org). 
  • Errors - While more sophisticated scams appear convincing, others can be identified by spelling errors and grammatical mistakes 

If you are unsure about whether a phone call or message is a scam, you may find the following tips helpful: 

  • Instead of clicking on links you’ve been sent, visit the website via a search engine or by typing in the address of the organisation 
  • Refuse requests to modify your login details or other settings 
  • If you recognise the organisation, call them on their official phone number and ask them to verify that it was them who contacted you 
  • Don’t answer calls or text messages from numbers you don’t recognise, as doing so confirms that the number is in use and could increase the amount of scam calls you get 
  • Never reveal personal or financial information to someone who contacts you unexpectedly 
  • Type the details of the call or text into a search engine to see whether others have reported it as a scam 

Additionally, it is wise to install anti-phishing software to block malicious emails. 

What to do if you are the Victim of Cyber Fraud 

If you are unfortunate enough to fall victim to a scam, it is important that you do the following: 

  1. Block or suspend the account that’s been compromised 
  2. Report the scam to your bank or the police 
  3. Report the scam to a fraud prevention body like ActionFraud or the National Cyber Security Centre (NCSC). 

Summary 

Phishing, smishing and vishing are all types of identity fraud, whereby scammers posing as businesses, banks, official bodies, or charities contact you in an attempt to steal your personal details or financial information. The fraudster encourages the recipient to voluntarily hand over confidential data or follow a link that installs malware like viruses, spyware, ransomware or adware on their device. 

The way you are targeted differs depending on which method the scammer uses, which nowadays can include a phone call, email or via text message, so it's vital to have a good understanding of how these scams work. 

You Might Also Read:

What Is Email Spoofing & How to Protect Your Organization:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« What The Latest Cybersecurity Trends Mean For Your SME 
Which Sectors Are Top Targets For Cyber Crime? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

European Defence Agency (EDA)

European Defence Agency (EDA)

EDAs mission is to improve European defence capabilities. Programme areas include Cyber Defence.

FireEye

FireEye

FireEye delivers unmatched detection, protection and response technology through an extensible and flexible cloud-based XDR platform.

Custodio Technologies

Custodio Technologies

Custodio Technologies was established as a Singaporean R&D Centre of Israel Aerospace Industries (IAI) in order to spearhead R&D activities in the field of cyber early warning.

redGuardian

redGuardian

redGuardian is a DDoS mitigation solution available both as a BGP-based service and as an on-premise platform.

Scantist

Scantist

Scantist is a cyber-security spin-off from Nanyang Technological Universiy (Singapore) which leverages its expertise to provide vulnerability management solutions to enterprise clients.

Baker Donelson

Baker Donelson

Baker Donelson is a law firm with a team of more than 700 attorneys and advisors representing more than 30 practice areas including Data Protection, Privacy and Cybersecurity.

UK Research & Innovation (UKRI)

UK Research & Innovation (UKRI)

UKRI works in partnership with universities, research organisations, businesses, charities, and government to create the best possible environment for research and innovation to flourish.

CyberWhite

CyberWhite

CyberWhite is a disruptive provider of cyber security and risk mitigation solutions.

Spamhaus

Spamhaus

Spamhaus is the world leader in supplying realtime highly accurate threat intelligence to the Internet's major networks.

Trusted Connectivity Alliance (TCA)

Trusted Connectivity Alliance (TCA)

Trusted Connectivity Alliance is a global, non-profit industry association which is working to enable a secure connected future.

SurePassID

SurePassID

SurePassID is a provider of highly secure, highly extensible multi-factor authentication (MFA) solutions.

BlackhawkNest

BlackhawkNest

Blackhawk is the only cyber security solution on the market that combines network monitoring and incident response into a cohesive appliance.

European Cyber Competence Network

European Cyber Competence Network

The purpose of the European Cyber Competence Network is to retain and develop the cybersecurity technological and industrial capacities of the EU necessary to secure its Digital Single Market.

Dataships

Dataships

We help companies automate their privacy compliance while building healthy, transparent data relationships with their customers.

CyberArmor

CyberArmor

Cyber Armor defend everyday IT and OT systems, from government agencies to critical infrastructure, from system integrators to small industries.

InnovateHer

InnovateHer

At InnovateHer, our vision is to make the tech sector more equitable, by increasing diversity across the spectrum and creating more inclusive workplaces.