Vishing and smishing

What it means

Vishing and smishing are variants of phishing that use channels other than email. Vishing, voice phishing, is a fraudulent phone call. Smishing, SMS phishing, is a fraudulent text message, and in a broader sense a message via messaging apps. Both belong to social engineering and exploit trust, fear and time pressure.

In vishing the attacker poses, for example, as someone from the bank, police, technical support, a supplier or a manager. They often use a spoofed number that appears familiar on screen and know some details about the victim, which makes them convincing. Voice imitation using artificial intelligence is increasingly used too.

Smishing typically contains a link to a fake page, for example asking the recipient to pay extra postage for a parcel, verify an account or pay a fine. After clicking, the victim enters login details or card data or installs a malicious app. Attackers combine channels: a text message prepares the ground and a call follows.

How it works in practice

In a business setting the most dangerous vishing targets accountants and people who approve payments. The attacker calls on behalf of the director or the bank and demands an urgent payment or confirmation of an operation in the app. As with BEC fraud, a clear rule helps: payments and bank detail changes are verified by calling back a known number, not the number the call came from.

Banks never ask for a PIN, password or SMS code and never ask you to confirm a payment you did not enter yourself. Strong customer authentication works only if the customer does not confirm an operation on a fraudster's instruction. If a call seems suspicious, hang up and call the bank on the number from its official website or card.

Prevention rests on regular training with concrete examples of current scams, on two-factor authentication and on a culture in which staff are not afraid to refuse a suspicious request, even one that seems to come from management. An agreed codeword for verifying urgent requests is a simple and effective safeguard.

What to watch out for

The biggest trap is trusting the number on the screen. Caller ID spoofing is technically easy, so even a familiar bank or colleague number proves nothing. A text message can likewise appear in the same thread as genuine messages from that sender. What matters is the content of the request, not where it appears to come from.

If fraud has occurred, act immediately: contact the bank and block the card or account, change passwords, report the incident to the police and, if personal data leaked, assess the duty to notify. The faster the company reacts, the better the chance of stopping the payment or limiting the damage.