Short answer: Smishing is phishing by SMS; vishing is phishing by voice call. Both aim at the same prize — your password, your verification code, or a payment — and both work because a text or a call feels more personal and more urgent than an email. The defence is one habit: never act on an inbound message about your accounts. Hang up, close the message, and reach the organisation yourself.
Why these two work better than email phishing
Email phishing has been around long enough that most people have some scepticism. Texts and calls bypass that in three ways.
Trust by channel. A text feels like it came from a person or a service you already deal with. Inboxes are full of marketing; a text is not.
No visible URL. On a small screen, links are shortened and truncated. You cannot hover to inspect a destination, and the domain is often cut off entirely.
Real-time pressure. A phone call is a live conversation with a person applying pressure. Nobody gets a chance to think, and thinking is what defeats these.
Caller ID and sender ID are both trivially spoofed, so a message appearing in the same thread as genuine texts from your bank proves nothing at all.
The smishing messages you will actually receive
- Delivery notifications. “Your parcel could not be delivered, pay a small fee.” The most common by volume, because almost everyone is expecting something.
- Bank alerts. “Suspicious transaction — reply STOP or call this number.” The number connects to the scammer.
- Account suspension warnings for streaming, mobile or utility accounts.
- Tax or government refunds, usually with a deadline.
- “Hi Mum” or “Hi Dad” messages from a new number claiming a lost phone and asking for money.
- Job offers with unrealistic pay, leading to a “registration” that collects your identity documents.
- Wrong-number openers — a friendly message that turns into a long conversation and eventually an investment opportunity.
The vishing calls
- Bank fraud department. “We have blocked a transaction. To cancel it, read us the code we have just sent.” The code authorises the transaction. See OTP scams.
- Tech support. “We have detected a virus on your computer” — leading to remote access software and a drained account.
- Mobile carrier. Often groundwork for a SIM swap, gathering the details needed to convince the real carrier later.
- Government or police impersonation, threatening arrest or fines.
- Courier at the door asking for the OTP that just arrived to “confirm delivery”.
- AI voice cloning — a relative’s voice, distressed, asking for urgent money. See AI voice cloning scams.
The rules that cover all of them
- Never share a verification code. No exceptions, no matter who is asking or why. Every organisation that sends codes says this, and every scam needs you to make an exception.
- Never call a number from a message. Use the number on your bank card, your statement, or the official website you navigated to yourself.
- Hang up and call back. If a caller resists this, that is your answer. Real organisations expect it. Use a different phone if you can, or wait a minute — call-holding tricks exist.
- Never click links in unexpected texts. Open the app or type the address yourself.
- Never install software because someone on the phone asked you to. Remote access tools are the tech-support scam’s entire mechanism.
- Treat urgency as the warning sign. Every one of these needs you to act before you think. Nothing legitimate collapses if you take ten minutes.
- Verify family emergencies independently. Call the person back on their known number, or ask something only they would know.
Reduce your exposure
- Move off SMS 2FA wherever an authenticator app or passkey is available. Codes generated on your device cannot be requested by a caller who triggered a login — see what is an authenticator app and passkeys vs 2FA.
- Set a carrier port-out PIN so vishing groundwork cannot become a SIM swap.
- Turn on your phone’s spam filtering and your carrier’s call screening.
- Report and block rather than replying. Replying confirms an active number.
- Reduce what is public. Scam calls are convincing because the caller has your name, address and date of birth from breach data — see checking what has leaked.
- Agree a family code word for emergency money requests. It costs nothing and defeats voice cloning outright.
If you have already responded
- Contact your bank immediately if money or card details were involved. Speed determines whether it can be stopped.
- Change the password on any account you entered credentials for, from a device you trust.
- Sign out all sessions on that account.
- Check recovery details and forwarding rules, especially on email — see what to do if your email is hacked.
- Re-enrol 2FA if a code was shared.
- Remove any remote access software installed during a call, and consider a full device reinstall — tech support scams frequently leave something behind.
- Report it to your national fraud reporting service, and to your carrier for the number.
Frequently asked questions
How do scammers have my name and details?
Data breaches, sold in bulk. Knowing your address or last purchase proves nothing about who is calling.
The number matched my bank exactly. How?
Caller ID spoofing is trivial and widely available. The displayed number is not evidence of anything.
Is it safe to answer unknown calls?
Answering is fine; acting on what you hear is the risk. Let unknown numbers go to voicemail if you prefer — genuine callers leave messages.
Can just opening a text harm me?
Almost never. The danger is clicking the link, calling the number, or replying. Delete and move on.
Why did I get a real code from my bank during the call?
Because the caller triggered a genuine login or transaction and needs you to read it out. The code being real is what makes the scam work.
Do these scams target older people only?
No. Delivery scams hit everyone, and job-offer and investment variants skew young. Confidence is not protection — the technique is designed to bypass it.
The bottom line
Smishing and vishing succeed by making you respond rather than think. One habit neutralises nearly all of it: never act on an inbound message or call about your accounts — end the contact and reach the organisation through a route you chose yourself. And never, under any circumstances, read out a code.
Want the technical layer too? Move critical accounts off SMS: SMS 2FA vs authenticator apps.