Vishing vs smishing: what is the difference, and which is more dangerous?

Same con, different channel. Here is how voice and text phishing differ, where they overlap, and why the newest attacks use both.

Vishing is phishing by voice call or voicemail. Smishing is phishing by SMS or messaging app. Both impersonate a trusted party to extract money, credentials or one-time codes. Smishing reaches more people per dollar; vishing converts better per contact because a live voice applies pressure in real time. Attackers increasingly chain them: a text first, then a call.

What is vishing?

Vishing is voice phishing: a scam carried out by phone call or voicemail, in which the caller impersonates a trusted party, such as a bank, a government agency, an employer's IT desk or a relative, to pressure the target into handing over money, credentials or a one-time code. The call may come from a human, a robocall, or an AI-cloned voice. Caller ID is frequently spoofed to match the impersonated party (FCC, caller ID spoofing). The full mechanics are in our vishing explainer.

What is smishing?

Smishing is SMS phishing: the same impersonation delivered as a text or messaging-app message, usually with a link to a fake login or payment page. The FTC reported 470 million dollars in losses to text scams in 2024, more than five times the 2020 figure, with fake package delivery notices, task-based job scams, fake fraud alerts, bogus toll notices and "wrong number" messages as the top five (FTC, April 2025). In FTC testimony to Congress in March 2026, text messages were the most frequently reported first point of contact for fraud in 2025 (FTC testimony, March 2026).

Vishing vs smishing vs phishing: how do they differ?

All three are social engineering. The channel changes what the attacker can ask for, how fast they can scale, and what the tell looks like.

Which is more common, vishing or smishing?

By volume, smishing. A text costs almost nothing to send and the FTC's 2025 data put text messages at the top of reported contact methods (FTC testimony, March 2026). By loss per victim, voice tends to win, because a live caller can keep a target on the line, answer objections and escalate the ask. The FBI's IC3 lumps unsolicited email, text and telephone impersonation together as phishing/spoofing; it was the single most reported crime type in 2025 with 191,561 complaints and 215.8 million dollars in losses, up from 70 million dollars in 2024 (FBI IC3 2025 report). The FTC's separate imposter-scam category, which spans every channel, reached 3.5 billion dollars in 2025 (FTC, June 2026).

The honest answer is that the question is becoming less useful. Attackers now pick the channel per step rather than per campaign.

How do attackers combine smishing and vishing?

The most damaging recent intrusions used both, in sequence.

• Text to harvest, call to finish. At Retool in August 2023, a text about payroll led an employee to a fake login page; the attacker then phoned, imitating the real voice of an IT staffer, and talked the employee out of a single MFA code (Retool, September 2023). The text got the password. The call got the second factor.
• Call to harvest, text to scale. Twilio reported a June 2022 vishing compromise of one employee, followed by hundreds of smishing texts to current and former staff with fake Okta pages (Twilio incident report, 2022).
• Either, aimed at the help desk. The joint FBI and CISA advisory on Scattered Spider describes the group posing as company IT or help desk staff using phone calls or SMS to obtain credentials, then persuading help desk staff to reset passwords or MFA tokens (CISA AA23-320A).
• Text first, call second, for consumers. The toll scam and the bank "fraud alert" both start as a text and convert to a call when the target replies or phones the number in the message. The FTC's 2026 alert notes government imposter reports rose 40% in 2025, led by toll texts (FTC, May 2026).

Security teams call the text-then-call pattern callback phishing or a telephone-oriented attack delivery. The defining feature is that the victim initiates the call, which defeats call-blocking and makes the caller feel legitimate.

What does the same scam look like in each channel?

Seeing one pretext in both formats is the fastest way to recognise it next time.

Why is vishing harder to defend against than smishing?

Three reasons, none of them about intelligence.

It happens in real time. A text sits there; you can re-read it, search the sender, ask someone. A call demands an answer now, and the caller controls the pace. Every vishing script is built to prevent the ten-minute pause that would end it.

The voice can now be anyone's. The FBI's 2025 report, the first with a dedicated AI section, records 22,364 AI-related complaints and about 893 million dollars in losses, and names voice cloning in both business email compromise and family distress scams (FBI IC3 2025 report). The FCC confirmed in February 2024 that AI-generated voices in robocalls are illegal without consent (FCC, 8 February 2024), which helps enforcement but does nothing on the call itself.

Caller ID is not authentication. The STIR/SHAKEN framework attests that a number was not tampered with in transit on participating networks; it does not confirm who is speaking, and it does not cover every call path (FCC, call authentication). Treat the displayed number as a claim, not a fact.

How do you protect against both?

The same three habits cover voice and text, because both attacks need you to act inside the channel the attacker chose.

1. Leave the channel. Do not tap the link, do not stay on the call. Open the app or dial the number on your card or in your contacts.
2. Never hand over a code. A one-time passcode is for you to type, not to read aloud or forward. No bank, agency or IT desk needs it from you (FTC, March 2024).
3. Treat urgency plus payment as proof. A deadline measured in minutes, attached to a transfer, gift card, crypto or remote-access request, is the scam.

The complete list, including family code words, SIM-swap protection and what to do if you already paid, is in how to protect yourself from vishing. For documented cases of each pattern see vishing examples.

Frequently asked questions