Blog: Security
Vishing vs phishing vs smishing: the channel nobody monitors
By the TelecomsXChange engineering team ยท
Phishing, smishing and vishing are one attack on three channels: e-mail, text message and voice call. The attacker impersonates someone trusted, asks for credentials, a code, money or access, and makes it urgent. What differs is how much defence each channel has: e-mail has the most, and voice, in most organizations, has none.
Definitions
Three words, one attack
- Phishing
- The attack by e-mail. A message that looks like it came from the bank, a supplier or a colleague, with a link to a fake login page or an attachment that installs something. The oldest form and the best defended: filters, link scanning, attachment sandboxes, banners on external mail, a report button.
- Smishing
- The attack by SMS text message. "Your parcel is held", "your account is locked", with a link. Shorter, harder to scan, and it reaches a personal phone. Carriers filter some of it, and an operator can run a model such as OpenTextShield, our open-source SMS phishing detector, on its own servers.
- Vishing
- The attack by voice call. The bank's fraud desk, the IT help desk, a government officer, the owner in a hurry, talking a person into reading out a code, sharing a password, granting remote access or sending a payment. The call is live, personal and urgent, and usually unrecorded. Seven examples of how it sounds.
Compared
What each channel has in its defence
| Question | Phishing (e-mail) | Smishing (SMS) | Vishing (voice) |
|---|---|---|---|
| Can the content be inspected before the person acts? | yes, filters and sandboxes | partly, carrier filters and models | no, it is a live conversation |
| Is there a record of what was said? | the message | the message | usually nothing |
| What do the standard controls judge? | sender, links, attachments, wording | sender, links, wording | the number (caller-ID labels, STIR/SHAKEN) |
| Is anyone alerted when a real one arrives? | yes, the report button and the filter | sometimes | no |
| Is the second attempt stopped? | often, by the filter | sometimes | no |
Attackers plan around these gaps. A campaign often runs a text first ("the fraud team will call you shortly") and the call second. The text lends the call credibility, and the call does the work in the one channel where nothing is listening.
Closing the gap
What monitoring the voice channel means
The same things the e-mail filter does, except that a conversation cannot be held for inspection, so the reading happens after the call, or during it in realtime mode: record every call in or out with each party on its own channel, transcribe it, score the transcript for the shape of the attack (impersonation, a request for value, urgency) with the red flags quoted, alert the team, block the flagged number's next attempt automatically, and keep the recording and transcript as evidence. Open Voice Shield does this as one hop on a business phone system or a carrier trunk, with no change on the phones. With OpenTextShield on the text side and the e-mail protection you already have, all three channels are read.
Start free with $5 credit, or read why the standard advice is not a strategy.
Questions
Frequently asked questions
What is the difference between vishing, phishing and smishing?
The channel. Phishing is the attack by e-mail, smishing by SMS text message, vishing by voice call. The attack is the same: someone impersonates an institution or a person the target trusts, asks for credentials, a code, money or access, and applies urgency. The defences differ by channel, and the voice channel usually has the fewest.
Why is vishing harder to stop than phishing?
E-mail is text, so it can be filtered, scanned and reported before anyone acts on it. A call is a live conversation: there is no link to scan, the pressure is real time, and the only record is the person's memory. Caller-ID labels and STIR/SHAKEN judge the number, not what is said. Stopping vishing means reading the conversation, which is what call analysis on the phone line does.
Do scammers combine smishing and vishing?
Often. A text warns that the bank's fraud team will call, then the call comes, and the text makes it credible. The SMS side can be filtered with a model such as OpenTextShield. The voice side needs the call itself scored. Covering one channel and not the other leaves the pair working.
What is the best protection against vishing for an organization?
Train people to hang up and call back, and put a control on the line that does not depend on them: every call recorded, transcribed and scored minutes after hangup, an alert with the red flags, the flagged number's next call blocked automatically, and the recording and transcript kept. Open Voice Shield does this as one hop on a phone system or a carrier trunk.