Vishing vs phishing comes down to how the scam reaches you. Phishing shows up in writing, usually an email. Vishing is a phone call. Both are someone pretending to be someone else so you’ll hand over access, money or data.
That sounds like a small difference. In practice it changes almost everything about how you defend against them.
| Phishing | Vishing | |
|---|---|---|
| How it arrives | Email, and sometimes chat or social media messages | A phone call, a voicemail or an internet call |
| The usual story | A problem with your account, an invoice, a shared file, a delivery | Your bank’s fraud team, the IT help desk, a government office, the boss |
| What they’re after | A click, an opened attachment, a password typed into a fake page | A code read out, an account reset, a payment, or remote access to your computer |
| Scale | One email can hit thousands of inboxes for next to nothing | One caller, one target at a time, often after some homework |
| A case from this library | Target (2013): an email to a contractor, then about 40 million card accounts exposed | Barclays impersonation (2024): a spoofed bank call, GBP 48,451.78 gone |
| What stops it | Email filters, checking the sender and link, phishing-resistant MFA | Hanging up and ringing back on a number you already have |
Key takeaways
Most comparison pages stop at “email versus phone.” The more useful difference is time. An email sits in your inbox. You can read it again tomorrow, look at who really sent it, hover over the link, or forward it to IT.
A call takes all of that away. The caller hears you hesitate and has an answer ready. Push back, and they come up with a new reason. They decide how fast things move. You can’t out-think that in the moment, which is why the advice for vishing is a set of rules you follow no matter how convincing the caller sounds.
It also isn’t the crude, low-skill scam some pages describe. The FBI and CISA advisory on Scattered Spider (AA23-320A) describes the group’s calls as attempts to “convince IT help desk personnel to reset passwords and/or transfer MFA tokens.” The same advisory says the group researches targets first, using social media, open-source information, commercial tools and data leaks.
The Clorox help-desk case shows how little a caller might need. According to Clorox, an outsourced service-desk agent read out a new password to someone who said they couldn’t connect, then reset MFA on the same call. Those are allegations in Clorox’s lawsuit, and as of September 2026 no court had found the vendor liable.
A malware-laced email landed at a small HVAC contractor and stole its login to Target’s vendor systems. With that login, the attackers got into Target’s network and put card-stealing malware on store registers. Nobody had to be talked into anything. The email did its job while everyone got on with their day.
Target’s filings confirm about 40 million payment card accounts and up to 70 million customer records exposed. Its Form 10-K for fiscal 2016 put the total cost of the breach at $292 million, or $202 million after insurance. Full case: Target vendor phishing breach.
Someone claiming to be from Barclays’ fraud team rang the owner of a family-run jewellery business about a suspicious payment and told him to call back. The callback number was a spoofed copy of the bank’s real one. They even played Barclays’ actual hold music.
A second caller then talked him into installing AnyDesk. That night he found GBP 48,451.78 missing from two business accounts. His law firm later said it got GBP 25,650 back after arguing Barclays should have flagged the activity. Full case: Barclays impersonation vishing.
The July 2020 Twitter hack shows the two working as a team. According to New York’s Department of Financial Services (DFS), the attackers phoned employees, said they were from Twitter’s IT department, and sent them to a fake VPN login page.
As employees typed in their credentials, the attackers entered them on the real site. That set off an MFA prompt, and some employees approved it. The attackers went on to target 130 accounts and took more than $118,000 in bitcoin from the public. DFS concluded that hardware MFA, a physical key plugged into the computer, “would have stopped the Hackers.”
The phone call brought the trust. The fake page grabbed the password. If you only defended against bad links, or only against suspicious calls, you’d have caught half of it. Full case: Twitter vishing account takeover.
Tip: before you act, ask how the request reached you and whether you can pause. Is it written down, and will it still be there in ten minutes? Then check the sender and the link like you would any possible phishing email. Is a person pressing you on a live call? Hang up and call back on a number you already have.
Callback phishing, sometimes called TOAD (telephone-oriented attack delivery), begins as phishing and finishes as vishing. The email often has no link at all, just a phone number to call about a charge or a renewal, which helps it get past filters that hunt for bad links. Whoever picks up then runs a vishing script.
The same handoff happens with texts. If the first contact is an SMS, see vishing vs smishing. For written lures sent by text, see smishing vs phishing, or browse the phishing case collection.
Yes. Phishing is the umbrella term for impersonation scams that try to get access, money or data out of people. Vishing is the voice version, done by phone call or voicemail, and smishing is the text-message version. Security teams still treat them separately because each channel needs different controls: filters for email, and process rules like calling back for phone calls.
That’s the attackers’ version, not an established fact. In September 2023 the ransomware group behind it claimed a “10-minute conversation” with MGM’s help desk got them in, and later described a different route. MGM’s SEC filings don’t say how it happened, though federal agencies do document this group calling help desks to get passwords and MFA reset. See the MGM Resorts case.
Mostly no. Email filters look for bad links and attachments, and a phone call never goes through them. The one exception is callback phishing, where the first contact is an email with a phone number in it, so filters that flag invoice-style lures and unfamiliar numbers can help. Once someone’s on a live call, only a process stops it: hang up and call back on a number you already have.
No. In a case reported in 2025, a Chicago small-business owner saw an incoming call matching the number on the back of her bank card. She then wired $20,000, by her own account, to callers posing as Bank of America. No source established how the match was produced, but the FBI warns that scammers may spoof a bank’s number. Hang up and dial the number on your card yourself. See the bank impersonation case.
Phishing shows up far more often in this library, mostly because it’s cheap: one message, thousands of inboxes. There are 72 cases tagged phishing and 27 tagged vishing, and some carry both. A case count isn’t a measure of risk, though. One convincing call to staff can open up a whole network, as Twitter and Clorox found out. See the library statistics.
Reviewed by SEE Team. Last reviewed 21 Oct 2026. How pages are researched and fact-checked. About Social Engineering Examples.
Social Engineering Examples