Phishing attack types: vishing, smishing, spear phishing and quishing
Phishing is a message that pretends to be someone you trust to get you to hand over a password, money or access. The kind depends on the channel: vishing is by phone call, smishing is by text message, quishing is by QR code, and spear phishing is an email written for one person. This guide explains each with a sanitised example, the tells, and what to do, then lets you test yourself with 15 real-or-scam questions.
Phishing
The same lure sent to many people, hoping a small share act. It imitates a bank, a delivery firm, a cloud service or an employer, and asks you to sign in, pay, or open a file.
Subject: Your mailbox is almost full. "Click here to keep receiving mail: mail-storage.example/renew". Sent from an address that does not match the company it names.
Tells
- The domain at the end of the link is not the company’s
- Urgency or a deadline
- A request to sign in from the message instead of from your own bookmark
What to do
Do not click. Open the service yourself and check there. Report the message with your mail client’s report button, then delete it.
Spear phishing
A message written for one recipient using real details: your manager’s name, a project, a supplier. The attacker has done research, often from LinkedIn, press releases or an earlier breach, so there is little of the clumsy wording people are trained to spot.
To a finance analyst: "Hi Priya, following up on the Halden Logistics renewal we discussed Tuesday. Revised terms attached, can you review before the 3 pm call?" The attachment opens a fake document-sharing sign-in page.
Tells
- It fits your work too well, but arrives from an unfamiliar address or thread
- An attachment or link you did not expect
- It asks for a decision before you can check
What to do
Confirm with the sender on a channel you already use, such as a message in your chat tool or a call to a known number. Report it to security even if you did not click.
Whaling
Spear phishing aimed at senior leaders, or using their identity to push staff into action. The prize is their access, or their authority to approve payments.
"I am boarding a flight and need you to process a confidential acquisition payment today. Do not discuss it with anyone until I confirm."
Tells
- Secrecy
- An instruction to bypass the normal approval process
- Reply-only contact
What to do
Payment changes and unusual transfers need a second approver and a call-back to a known number, no matter who appears to ask.
Smishing (SMS phishing)
Phishing by text. Messages are short, often from unknown numbers or email-to-text gateways, and lean on delivery problems, unpaid tolls or fines, bank alerts and job offers. Texts feel personal and small screens hide the address.
"Parcel #4471 is held. Update your delivery address within 12 hours: parcel-redeliver.example/4471".
Tells
- A link from a number you do not know
- A small payment or a short deadline
- A company you have no dealings with
What to do
Do not tap. Delete and block, or forward it to 7726 (SPAM), which the FTC says helps your wireless provider block similar messages, and report it at ReportFraud.ftc.gov. If it might be real, open the company’s app or website yourself.
Not sure about a link in a text? Paste it into the link warning-sign checker. It does not open the link.
Vishing (voice phishing)
A caller pretends to be your bank, tech support, a government agency or your IT help desk. Voices can now be imitated with software, and caller ID can be faked, so neither a familiar voice nor a familiar number proves who is calling. Callers build fear or urgency and keep you on the line so you cannot check.
"I’m calling from IT security. We’ve seen a sign-in from another country. I’m sending a verification code to your phone. Please read it back so I can lock the intruder out."
Tells
- They called you and ask you to prove who you are
- They ask for a one-time code, a password or remote access
- They tell you not to hang up or not to tell colleagues
What to do
Hang up. Look up the number yourself and call it. No bank or IT team needs you to read out a one-time code. Pre-agree a passphrase with family and with your finance team for unusual requests.
For cloned voices and finance-team controls, see the voice clone fraud defense checklist and our page on deepfakes.
Quishing (QR code phishing)
A QR code that opens a malicious page. Because the link is an image, email filters read it less well and the phone screen hides the address. Attackers also stick QR codes over real ones on parking meters, posters and menus.
An email titled "Action required: re-enrol your authentication app" contains only a QR code and a company logo.
Tells
- A QR code in an email asking for a sign-in
- A sticker placed over a printed code
- The preview address does not match the service
What to do
Preview the link before opening it. Do not scan codes sent by email that ask you to sign in. Use the operator’s own app. Report to IT if it came to a work address.
Business email compromise (BEC)
A fraud rather than malware. Someone impersonates an executive or supplier, or takes over a real mailbox, and persuades finance to send a payment or change bank details.
"We have changed banks. Please use the new account details below for all future payments."
Tells
- New bank details
- Pressure to pay today
- Reply-to address that differs from the sender
What to do
Verify any change of payment details by phone using a number you already hold. If a payment has gone, contact your bank immediately and ask for a recall. See the BEC wire recall triage tool.
If money has already gone, use the BEC wire recall triage.
Quiz: real or scam?
Fifteen invented messages, calls and QR scenarios. Some are real. For each one, decide, then read why. For more, try Pick the Phish.
Northwind Bank ALERT: Unusual sign-in blocked. Confirm your identity within 30 minutes or your card will be frozen: northwind-secure-id.example/verify
Habits that beat every type
- Switch channels. If a message asks for action, confirm it through a website or number you find yourself.
- Treat urgency and secrecy as the warning sign. Both are there to stop you checking.
- Never read a one-time code to anyone.
- Use passkeys or security keys where you can, so a fake page has nothing to steal. See the phishing-resistant MFA planner.
- Report, even if you did not click. One report can protect your whole team.
Related
Paste a suspicious link and see the warning signs in how it is written. Not a reputation lookup.
Pick the PhishA short game for telling real emails from fakes.
DeepfakesHow cloned voices and faces power the newest vishing and fraud.
Voice clone fraud defense checklistControls that make a cloned voice useless against your finance team.
BEC wire recall triageWhat to do in the first hours after a fraudulent transfer.
Phishing-resistant MFA plannerPlan a move to passkeys and security keys.
Frequently asked questions
What is phishing?
Phishing is a message that pretends to come from a trusted source to get you to reveal a password, make a payment or install something. It can arrive by email, text, phone call, QR code or messaging app.
What is the difference between phishing and spear phishing?
Phishing is sent to many people with a generic lure. Spear phishing is written for one person or team using real details about them, so it is more convincing and usually aimed at access or money.
What is vishing?
Vishing is voice phishing: a phone call or voicemail where the caller pretends to be your bank, tech support, a government agency or your boss to get information or money. Hang up and call back on a number you look up yourself.
What is smishing?
Smishing is phishing by text message. The texts usually claim a delivery problem, an unpaid toll or fine, or a bank alert, and contain a link or a number to call. Do not tap the link; delete the message and go to the company’s app.
What is quishing?
Quishing is phishing with a QR code. The code opens a fake page, and because the link is hidden inside an image, filters and people both find it harder to check. Preview the link and avoid scanning codes that arrive by email asking you to sign in.
How can I tell a real message from a scam?
CISA lists four signs: urgent or emotionally charged language, requests for personal or financial information, untrusted shortened links, and incorrect email addresses or links. Poor grammar is no longer reliable, because tools produce polished text. Verify through a website or number you find yourself.
What should I do if I clicked a phishing link?
Do not enter anything further. If you entered a password, change it at the real site and anywhere you reused it, and turn on multifactor authentication. If it was a work account or device, tell your security team straight away: speed limits the damage.
Does multifactor authentication stop phishing?
Not all kinds. One-time codes can be phished or talked out of you by phone. Phishing-resistant methods such as passkeys and hardware security keys tie the login to the real website, so a fake page cannot reuse them.
Sources
- CISA, Recognize and Report Phishing: the four signs of phishing and the recognize, resist, delete, verify steps (read 3 November 2026).
All examples on this page are invented, use fictional companies and reserved example domains, and contain no working links or phone numbers.