Phishing uses email, vishing uses phone calls, smishing uses text messages, and a SIM swap moves a victim's phone number to the attacker's SIM. All aim to get a person to hand over access. The best common defense is phishing-resistant MFA plus a habit of verifying through a channel you started.
Phishing
Messages, usually email, that pretend to be a trusted sender and push you to click, log in or pay. CISA lists urgent or emotional language, requests for personal or financial information, untrusted shortened URLs and incorrect addresses or links as signs. Defense: verify by going to the site yourself and report the message.
Vishing
Phishing by voice. CISA's Scattered Spider advisory describes spearphishing voice calls, including multi-call campaigns that gather password-reset procedures and employee details, then pressure help desk staff into resetting passwords or transferring MFA tokens. Defense: callbacks to known numbers and strict reset rules. See help desk controls.
Voice can also be cloned. The FBI warns criminals use AI generated audio. See the verification policy.
Smishing
Phishing by text message. The FTC says to forward phishing texts to 7726 and report at ReportFraud.ftc.gov. Texts are short, so there is little to inspect, and links are often shortened. Defense: do not tap, and open the service directly.
SIM swap
Not a message but an account change at the carrier. CISA's advisory says actors persuade cellular carriers to move a victim's phone number to a SIM they control, giving them access to calls, texts and MFA prompts sent to that number. Defense: do not rely on SMS for MFA on important accounts, and use a carrier account lock if offered.
Push bombing
Related, though not a message type: repeated MFA prompts until someone approves. See MFA fatigue.
Side by side
- Phishing (Email): Verify out of band, report
- Vishing (Voice call): Callback to known number
- Smishing (Text): Do not tap, open the service directly
- SIM swap (Carrier): Avoid SMS MFA, use keys
- Push bombing (MFA prompts): Number matching, then FIDO
What ties them together
Each one asks a human to bypass a normal process under pressure. That is why a written rule such as "we never reset MFA on an inbound call" works better than hoping staff will spot every trick.
A rule worth writing down
Pick one sentence per channel and make it policy. For calls: we never reset MFA on an inbound call. For texts: we never ask you to log in through a link. For email: payment changes are always confirmed by phone. Short rules are easy to remember under pressure, and they give staff something to point to when a caller pushes back.
Quick check
Which of these does MFA with a security key stop best?
It stops credential phishing, push bombing and SIM swap based interception, as CISA says FIDO resists push bombing and SIM swaps. It does not stop a person from handing over access in a call.
Is smishing less risky than email phishing?
Not necessarily. Texts are short and links are easy to hide, so people judge them poorly.
Sources
- CISA: Recognize and report phishing
- CISA advisory AA23-320A, Scattered Spider
- FTC: How to recognize and avoid phishing scams
- FBI PSA I-120324-PSA (IC3)
Last reviewed: 19 October 2026.
