Vishing vs phishing: what is the difference?

Phishing is written and asynchronous, so the target can re-read it, forward it, or check it later. Vishing is a live phone call. The attacker hears hesitation and adapts to it in real time, which is why vishing defeats people who would have spotted the same request in an email.

An email can be inspected at leisure. A call cannot. The attacker controls the pace, supplies reassurance the moment doubt appears, and can invent detail on the spot. Voice also carries an authority signal that text does not, particularly when the caller claims to be IT or an executive.

The corpus shows how much this matters. This library records 62 phishing cases and 32 vishing cases, so vishing is less common. But vishing appears in three of the five largest disclosed losses documented here.

Documented cases

• The Clorox and Cognizant help-desk breach cost $380M. The attacker phoned the outsourced service desk posing as an employee and had credentials and MFA reset over the phone.
• The MGM Resorts breach of 2023 cost $100M and used the same route: a call to the help desk, not an email.
• The Jaguar Land Rover shutdown of 2025 carries a reported $350M figure and began with a vishing call.
• For contrast, Target in 2013 at $292M shows email phishing reaching a comparable scale by a different route.

The control that breaks it

• For vishing specifically: call back on a number sourced independently, never one the caller supplies, and never treat a voice as proof of identity.
• Help desks need an identity-proofing step for credential and MFA resets that does not rely on information an attacker can research.
• No exception for seniority, urgency or a claim of confidentiality, since those are the pressure levers the call is built on.