Smishing (SMS Phishing)
Years of security training have made many people suspicious of email links. Attackers adapted. SMS messages carry an implicit trust that email has largely lost — we associate texts with people we know, not with spam.
Smishing is phishing conducted via SMS. Common scenarios:
- "USPS: We attempted delivery but your address is incomplete. Update here to reschedule: [link]" — The link requests a small "redelivery fee," capturing credit card details.
- "Your bank has detected unusual activity. Verify your identity immediately: [link]" — Creates fear and urgency, redirects to a credential-harvesting page.
- "You have a pending package from Amazon. Confirm your address: [link]" — Exploits the near-universal experience of waiting for deliveries.
The mitigation is the same as for email phishing: never click links in unsolicited messages. Navigate directly to the official website or call the organization using a number from their official site.
Vishing (Voice Phishing)
Vishing uses phone calls to extract information or manipulate targets. VoIP technology makes it trivial to spoof caller ID, so a call can appear to originate from "IT Support — Internal," "Your Bank," or even a colleague's direct line.
A classic vishing scenario: an attacker calls a helpdesk employee, claims to be a senior manager locked out of their account before an important presentation, and uses urgency and authority to pressure the helpdesk into resetting credentials without following the standard verification procedure.
AI Voice Cloning (Deepfakes): This attack vector has escalated dramatically. Attackers can now clone a person's voice from as little as 30 seconds of publicly available audio — a YouTube interview, a podcast appearance, a company all-hands recording. They then generate a synthetic voicemail:
"Hi Sarah, it's [CEO Name]. I'm stuck in back-to-back meetings but I need you to authorize that vendor payment we discussed last week — it's time-sensitive. I'll explain everything when I'm out. Thanks."
The voice is indistinguishable from the real CEO. The Finance Director, who has heard this voice on dozens of all-hands calls, has no reason to doubt it. In 2019, a UK energy company transferred €220,000 after an executive received a call from what he believed was his CEO — the voice was AI-generated.
The Mitigation: Establish out-of-band verification for any high-value request. If a voice message asks you to take a financial or security-sensitive action, call back on a number you independently look up — not a number provided in the message. For wire transfers, require a second approver regardless of who is asking.