Phishing vs smishing vs vishing: What is the difference?

Phishing, smishing and vishing are the same crime delivered through different channels. Phishing uses email, smishing uses text messages and vishing uses phone calls or voicemail. In each case a criminal impersonates someone you trust to steal login details, personal data or money. The tactics and warning signs overlap almost completely, so they are best defended against together.

The three terms cause more confusion than they should, partly because "phishing" is used both for the email version and as the umbrella name for the whole family. This guide sets out what each one is, how they differ, which is the most dangerous for a UK organisation and how attackers now combine them in a single campaign.

What is the difference between phishing, smishing and vishing?

The difference is the delivery channel and almost nothing else. All three are forms of social engineering: The attacker manipulates a person rather than breaking a system. The pretext is usually the same (a bank, a courier, HMRC, a supplier, the IT department, a senior colleague) and so is the aim, which is either to get you to hand over a password, a passcode, card details or a payment or to open a door into your organisation's network.

	Phishing	Smishing	Vishing
Channel	Email	SMS, WhatsApp and other messaging apps	Phone calls and voicemail
Name origin	"Fishing" for victims, spelt with ph in hacker slang	SMS plus phishing	Voice plus phishing
Typical lure	Fake invoice, shared document, password reset, delivery notice	Missed parcel, tax refund, bank alert, "Hi Mum" message	Bank fraud team, IT help desk, HMRC, courier, Microsoft support
Usual goal	Credential theft, malware, invoice fraud	Credential theft, card details, passcode capture	Passcodes, remote access, payments, password resets
Where security tools help	Email filtering, link scanning, report button	Operator blocking only; nothing on a personal SIM	Almost none; caller ID can be spoofed
What defeats it	Trained staff, MFA, reporting culture	Trained staff, MFA, 7726 reporting	Trained staff, call back verification, strict help desk process

The last two rows are the important ones, because the further an attack moves from email, the less your technology can see and the more the outcome depends on the person receiving it.

What is phishing?

Phishing is the original and still the most common form, a fraudulent email impersonates a trusted sender and asks the recipient to click a link, open an attachment or reply with information. The government's Cyber Security Breaches Survey 2026 found that phishing was the most prevalent attack type identified by UK organisations, reported by 38% of businesses and 25% of charities, and that among businesses that experienced cyber crime, 93% experienced phishing.

Because email has been the main channel for two decades, it is also the channel with the most mature defences: Spam filtering, domain authentication such as DMARC, link rewriting and one click reporting inside the inbox. Those defences are the reason attackers have moved sideways into text and voice, where none of them apply. Our guide to the common signs of a phishing email covers the email version in depth.

What is smishing?

Smishing is phishing by text message, the name blends SMS and phishing, although the same attacks now arrive by WhatsApp, iMessage and RCS. A typical smishing text impersonates a courier, a bank, HMRC or a mobile network, creates urgency and links to a copycat website that harvests details. The "Hi Mum" scam, in which a criminal poses as a child with a new phone, is the best known variant that relies on a relationship rather than a brand.

Smishing is effective because texts are read almost immediately, the phone screen hides most of a link's real destination and corporate security tools never see a text on a personal SIM. Ofcom's 2026 research found that 40% of UK mobile users received at least one suspicious message in a three month period. For the full picture, read what is smishing? SMS phishing explained.

What is vishing?

Vishing is phishing by voice, the attacker phones the victim or leaves a voicemail asking for a call back, while impersonating an organisation or a person in authority. Classic examples are the "bank fraud team" call that asks you to move money to a safe account, the "Microsoft support" call about a virus on your computer and in a corporate setting, the caller who poses as an employee to persuade the IT help desk to reset a password or multi-factor authentication device.

Vishing has become the intrusion method of choice for serious criminal groups because a live conversation can adapt to objections in real time and because caller ID is easy to spoof. The 2025 attacks on Marks & Spencer and the Co-op, which the Cyber Monitoring Centre estimated cost between £270 million and £440 million in total, most likely began with social engineering of IT help desk processes. AI voice cloning has raised the stakes further: Starling Bank research in 2024 found that a voice can be cloned from as little as three seconds of audio, and that 28% of UK adults believed they had been targeted by a voice cloning scam in the previous year. Read what is vishing in cyber security? for the detail.

Which is the most dangerous: Phishing, smishing or vishing?

It depends on what you measure, by volume, email phishing is far ahead and will remain the attack most staff encounter most often. By cost per incident, the phone wins. UK Finance's Annual Fraud Report 2026 shows that authorised push payment fraud reached £576.4 million in 2025 and that scams originating through telecommunications, meaning calls and texts, made up 17% of cases but 28% of losses. Online origins accounted for 66% of cases but only 32% of losses. A phone based scam is rarer but when it lands it takes far more.

For an organisation, the answer is that the most dangerous attack is whichever one your defences are not built for. Most UK businesses have invested in email security and email based awareness. Far fewer have trained staff to challenge a caller, verify a text or refuse to read out a passcode. That gap is precisely what attackers now target.

How do attackers combine phishing, smishing and vishing?

The most effective modern campaigns do not pick one channel. They chain them, because each step makes the next more believable.

A common sequence starts with an email that contains no link at all, just a fake invoice or subscription renewal and a phone number to call if you want to cancel. The email passes the filters because there is nothing to scan and when the victim calls, a friendly agent walks them through "cancelling", which in practice means installing remote access software or reading out card details. Security researchers call this call-back phishing or telephone oriented attack delivery.

Another sequence targets multi-factor authentication, the attacker has already obtained a stolen password. They trigger a flood of login approval prompts to the victim's phone, then phone the victim posing as IT support, apologise for the "glitch" and ask them to approve the next one. Or they text first, warning that the IT team will be calling about a security issue, so the call feels expected.

A third sequence works in reverse: A text or email gathers enough personal detail about an employee for a later vishing call to the help desk to sound authentic. The caller knows the employee's name, manager, start date and last holiday, so the reset request seems routine. This is the pattern behind the retail attacks of 2025.

The lesson is that a text can be the first step of a breach that finishes on the phone and staff need to recognise the pattern across all three channels rather than treating each in isolation.

Where do spear phishing, whaling and quishing fit in?

These terms describe variations within the same family, defined by target or medium rather than channel. Spear phishing is any phishing attack aimed at a specific person or organisation, using personal detail to make it convincing, and it can arrive by email, text or call. Whaling is spear phishing aimed at senior executives, whose approval can move money or unlock systems. Quishing uses a QR code, often in an email or on a printed notice, to take the victim to a malicious website while bypassing link scanners. Business email compromise, where an attacker takes over or imitates a genuine business email account to redirect payments, is the most costly form of email phishing and is covered in our complete guide to business email compromise.

A related UK term is blagging, the deliberate use of a false pretext to obtain information, which is essentially what vishing is when done by phone. Our explainer on phishing vs blagging covers the distinction.

How do you protect your organisation against all three?

The NCSC's guidance on defending against phishing describes four layers: make it harder for attacks to reach people, help people identify and report them, limit the damage when one succeeds and respond quickly. The first layer is mostly technical and mostly about email, the other three apply equally to text and voice and they all depend on people.

Practically, that means three things: Enforce multi-factor authentication everywhere, prefer phishing-resistant methods for privileged and finance accounts and give your help desk a verification process that cannot be talked around. Set clear, simple rules that staff can quote back to an attacker: IT will never ask for your passcode, finance will never change bank details on a phone call and any urgent request gets verified through a known number. And train people on the pattern rather than the channel, so a member of staff who has learned to pause and verify does so whether the pressure arrives by email, text or call.

Boxphish's cyber security awareness training is built for exactly that. The curriculum, aligned to NCSC guidance and updated as threats change, covers phishing, social engineering and impersonation, including voice and text based scams, in short video and quiz based modules. Phishing simulations turn the knowledge into habit by testing staff safely and often and the results are measured in analytics that show which teams still carry the most risk. The evidence is strong: Analysis of more than 400,000 Boxphish platform users found that untrained users are 8.8 times more likely to click a phishing link than trained users. Because Boxphish syncs users from Microsoft 365 and delivers training inside Microsoft Teams, all of this runs with minimal effort from the IT team, which is what makes human risk management practical for organisations without a dedicated security function.

Phishing vs smishing vs vishing in summary

Phishing is by email, smishing is by text and vishing is by phone. They share the same psychology, the same pretexts and the same goals, and the most damaging attacks now chain all three. Email is the most common, the phone is the most costly and text is the one your security tools cannot see. The defence that works across every channel is a workforce trained to recognise pressure, verify independently and report without fear.

To see how Boxphish trains staff against every form of phishing in one programme, book a demo.

Frequently asked questions