At their core, all four terms are a type of financial fraud which tricks unsuspecting victims into giving out sensitive personal information, handing over money or installing malware onto their device.
The only difference between each term is the channel via which you can be targeted; phishing refers to scam emails, smishing refers to scam text or WhatsApp messages and vishing takes place over the phone.
Added to these there is now a growing trend for 'quishing' or QR-code phishing.
The use of Artificial Intelligence (AI) in these scams are making attacks even harder to detect than ever. Fraudsters can create personalised and targeted communications, and even clone the voices and images of genuine individuals to make their attacks more believable.
Phishing
The most common phishing method encourages victims to visit a malicious website through a fake email message, which appears to be sent from a legitimate company or source (e.g. from a bank, HMRC, a delivery company or the NHS).
For example, you might receive an email which appears to be from an organisation who you’re familiar with, asking you to click on a link. At this point you will be taken to a webpage on which you’re asked to submit sensitive data, such as passwords, usernames or bank details. This might sound like an obvious trick, but cyber criminals are highly adept at creating authentic looking emails and fake websites which lull victims into a false sense of security as they can look just like the real thing.
Another common method of attack uses emails that appear to come from a legitimate source, but include attachments containing dangerous software (otherwise known as ‘malware’) which could be capable of stealing personal information. The attachment might be labelled as ‘receipt’, ‘invoice’ or something equally enticing to encourage you to open it, at which point the malware is downloaded onto your device. Malware that we have seen affecting customers includes 'InfoStealer' software, that tracks what you type, so can steal passwords and usernames when you log into websites.

Smishing
Smishing follows largely the same pattern as phishing but it takes place over text (also known as SMS) or messaging services like WhatsApp.
For example, you might have heard of the Royal Mail scam, in which thousands of people around the UK received a fake text message claiming that payment was required in order for a package to be delivered. Recipients of the message are instructed to click on a link, directing them to a fraudulent website which collected personal and payment details.
Vishing
Unlike phishing or smishing, vishing refers to over-the-phone fraud where criminals will call you, posing as your bank or another seemingly reputable company, in order to verbally obtain sensitive data such as passwords, addresses and so on.
You may be familiar with the HMRC vishing scam, in which fraudsters used an automated phone call to convince victims that they had unpaid tax bills to settle, conning them out of hundreds of pounds. In this particular case the criminals were able to mimic the official HMRC number and used the threat of filing a lawsuit against the victims to scare them into making the payment.
Fraudsters use psychological techniques to put victims in a state of panic or urgency, often threatening legal action or claiming that there will be negative consequences (e.g. that your account will be frozen) unless you act immediately.
Quishing
This is where QR codes are used to direct you to a scam website. An example of QR code phishing is where fraudsters place fake QR codes on car parking payment machines to defraud drivers by directing them to a fake payment webite. Not only do the fraudsters take your money, but you will not have paid the legitimate parking fee - so you could get hit again by a fine!
Fraudsters will try and rush you into complying with actions such as moving your money to a ‘safe’ account (one of theirs!) They may even use tactics such as the threat of arrest or fines. Don’t panic, hang up, and then call the bank on the number on our website.
How to protect yourself
Follow these helpful dos and don’ts to prevent yourself from becoming a victim of a phishing attempt…
Don't
- Disclose any card security details, like your PIN number, Internet Banking log in details or card number, over the phone, by email or text message or via a link included in an email or text.
- Feel rushed or pressured into making a decision. No genuine bank or other legitimate organisation would ask you to carry out a transaction on the spot.
- Assume that an email, phone call or text message is authentic. If in doubt hang up the phone or delete the email or text message without opening it.
- Click on links or attachments included in unsolicited emails or text messages.
Do
- Report scam texts and mobile calls to 7726. See Ofcom's advice on how to do this from your mobile device.
- Call companies back using the number on their trusted website. If you are unsure whether a phone call, email or text message request is genuine, it always best to call the organisation back using the number on its genuine website to confirm. Do not reply on contact details provided through emails, phone calls or text messages.
- Check email addresses, phone numbers and URLs carefully – do they look suspicious?
- Install up-to-date anti-virus software on your devices.
- Follow the ABC framework for fraud: Accept nothing, Believe no-one and Confirm everything.
- Which? provide free monthly alerts on recent scam trends. Consider keeping up to date by visiting their website to find out more.
Report suspected fraud
If you think you may have been a victim of fraud, call us immediately on 0330 355 0355. We're here 8am-6pm Monday - Wednesday and Friday, 9am-6pm on Thursdays, and 10am-4pm on weekends for fraud queries. If abroad, call +44 (0)117 9739339.
You can report smishing to your network provider on 7726.
Explore our information and advice about fraud – know what to look out for and how to stay safe.
very useful
Very helpfu and timely.
Terrific. Thank you. I thought I was Mrs A1 cautious but I was silly enough to fall for the Royal Mail scam. Top marks to TRIODOS for excellent customer care .. and for not treating me as a silly old 60 something when I realised what I'd done.
Always use a different phone to call your bank. You forgot to warn about callers staying on the line to deceive you again. I collect all undelivered mail from the sorting office when the postman leaves a card. I have full screening on my landline phone. I have another bank account to transfer funds to, but say I'll sort it out in the branch.
Very helpful, have made a note of the numbers to call if needed.
very helpful, and yes, I have been the target of all the scams you mention. Thankfully i didn't fall for them.
Very good, but one important omission. Sometimes a scammer will tell the victim to hang up and phone (their bank, say) but will stay on the line and play dial tone back to the victim. They think they're making a new call, but they're still connected and the scammer's accomplice 'answers the call' and begins the second phase of the attack.
Informative, clear to read. If there is a Government site that has advice on cyber security, perhaps include that in the information
Thank you - appreciate the reminders. (I have also deleted a genuine text from DPD and blocked their number through being over-cautious; they need to make their systems not look like scammers!) There's also the WhatsApp or text scam where someone messages you starting with "Hi Mum, this is my new phone" (or "Hi Dad"). I've agreed security clues to use with my parents or husband if we ever need to do this.
Clear information and useful
Very clear and useful. Thank you.
Thanks for explaining the difference between the three - they're all equally to be avoided!
Very useful, as ever. My only query is the advice to never give your card number out on the phone. SUrely you do this every time you buy stuff over the phone, but I suppose the difference is that you've initiated the interaction yourself in order to buy something, rather than having been rung up and asked for it.
Hi Hazel, thanks for your question – and you’re right! If you receive a call from someone claiming to be from a company and asking you to make a payment, you should call them back on the number you find on their website to be sure that you’re definitely talking to them. Be aware that fraudsters can also mimick the telephone numbers of genuine organisations, so they show up on your caller ID. Whereas if you’ve initiated the call using a number you know to be correct, you can be more confident that you’re speaking to the right person. The sad fact is, if you give your debit card details to anyone, they could use it to make a payment and scam you. So make sure you check your bank statements regularly and get in touch if you notice any unusual or suspicious transactions. Hope this helps. Many thanks, Alana
Clear and helpful explanation
Excellent advice. Thank you. It certainly helps to make one more aware of these menacing scams.
A timely reminder. I'm inundated with Spam emails even though I've signed up with TPS
Very useful & very necessary!
Excellent thanks
Very helpful, thank you. Can I check my computer for malware? Can it be removed?
Great advice especially coming up to the busiest time of the year
Excellent as very clear and detailed for clarit
Very helpful, thank you
excellent it helps me understand the 3 methods of fraud
Very helpful, but in a list of Don'ts I think you should also start every item with the word Don't, so that the positive version of the sentence doesn't get seen or remembered.
Useful but there should be more of them
Very helpful, also by listing how to report scams. And don't be embarrassed -- if it's not reported the authorities have no chance of countering it!
Very helpful. Thank you.
Excellent advice. Thank you for reminding me.
Useful, if frightening!
Very clear and helpful.
Clear and helpful thanks.
Very useful. Thanks.