Vishing vs smishing is call versus text. Smishing reaches you as a text message. Vishing is a phone call. Either way it’s phishing, and it’s aimed at whatever phone you’re holding.
Smishing: a short text, SMS or WhatsApp-style, that wants a tap, a reply or a call back.
Vishing is a caller, real or recorded, talking you into giving up a code, a password, a payment or access.
| Smishing | Vishing | Phishing (email) | |
|---|---|---|---|
| How it arrives | A text or a messaging-app message | A phone call or voicemail | An email |
| The usual story | An unpaid toll, a missed delivery, a bank alert, a payroll glitch | Your bank’s fraud team, the IT help desk, your phone company | An account notice, an invoice, a shared document |
| What they’re after | Card details or a login typed into a look-alike site | A code read out, an account reset, a payment, remote access | A click, an attachment, a typed password |
| Scale | Big batches of near-identical texts | Usually one caller working one person | Thousands of emails in one go |
| A case from this library | Toll-road texts (2024 to 2025): more than 2,000 FBI complaints by April 2024 | Optus and TPG support calls (2023 to 2024): police found more than 100 victims | Target (2013): a contractor’s email opened the network |
| What stops it | Don’t tap. Open the app or type the official address yourself | Never read out a code. Hang up and call a number you know | Email filters and phishing-resistant MFA |
Key takeaways
People get confused when a text and a call turn up in the same scam. The rule this library uses for tagging is simple: classify the attack by the channel the target first engaged with.
The toll-road scam is pure smishing. Texts warned about a small unpaid toll and a late fee and linked to a fake payment page. No caller anywhere. Full case: toll-road smishing wave.
The Optus and TPG case goes the other way. Australian Federal Police (AFP) allege callers pretended to be phone company staff, saying the line was under maintenance or offering a cheaper new device. Then they got the customer to hand over the one-time PIN sent for authorization, which police allege was used to buy high-end phones on the customer’s account and sell them offshore.
A code arriving by SMS doesn’t make that smishing. By the AFP’s account, the trick happened on the call. Investigators identified more than 100 victims, and police allege they found more than AUD $1 million in cash at the accused’s home. The charges haven’t been proven. Full case: Optus and TPG one-time PIN vishing.
Retool’s August 2023 breach is the example people reach for when smishing and vishing work together. Several employees got a text from someone claiming to be IT, saying their payroll system was out of sync ahead of open enrollment, with a link to a fake login page. One employee typed in a password and a one-time code.
Then the attacker called that employee, posing as IT, and seemed to know the office floor plan, coworkers and internal processes. The employee got suspicious but still gave up one more code. That let the attacker add their own device to the account, and eventually take over 27 customer accounts.
Two details often get reported wrong. Retool said the caller deepfaked a real employee’s voice, but it released no evidence, and Ars Technica called the claim completely unverified. And the roughly $15 million crypto loss was disclosed by a customer, Fortress Trust, which CoinDesk linked to the breach. Retool has never put a figure on it. Full case: Retool smishing and vishing breach.
Smishing is a numbers game. In April 2024, the FBI’s Internet Crime Complaint Center (IC3) said it had received more than 2,000 complaints since early March about toll-debt texts in at least three states. The alert reproduced the message, which opened: “We’ve noticed an outstanding toll amount of $12.51 on your record.”
The same alert said to check your account on the toll service’s real website or call its customer service line, and to report the text to IC3. There are more cases in the smishing case collection.
Tip: look at what the message wants from you. Tap, reply or call this number? That’s smishing. A caller wanting a code, an approval or a software install? That’s vishing. Either way, stop replying and get in touch with the company yourself, through its app or a number you trust.
Email phishing is the third member of the family, and the one most company defenses were built around. At work, email gets screened before anyone opens it. Texts don’t. They land on personal phones. Calls skip every filter and reach a human.
The lures overlap more than the channels do. Retool’s fake login page could just as easily have come by email. For the email side, see vishing vs phishing and smishing vs phishing, or browse the vishing case collection.
Who’s doing the work. In smishing it’s you: you tap, you type your details into the fake page, you reply. The text just has to seem real for a few seconds. In vishing it’s the attacker, talking. They can answer your doubts and change the story as they go, but a caller can only get through so many calls a day.
Both, one after the other. It starts as smishing because the text came first, and once you dial, the rest is vishing. Treat the number in the text as part of the lure. Look up the organization’s number yourself, from its app, your card or a statement. The email version of the same trick is called callback phishing.
Yes, if they get you to share it. At Retool, an employee typed one code into a fake page and gave a second to a caller. In the Optus and TPG case, police allege callers got the one-time PIN sent to each customer. A code only protects you while it stays with you, which is why phishing-resistant MFA like FIDO2 security keys gets rid of the code altogether.
Don’t tap the link and don’t reply. Check the claim yourself through the organization’s official app or website. In the US, report it to the FBI at ic3.gov, with the sending number and the link. Federal guidance on the toll-road texts also suggests forwarding them to 7726 (SPAM), then deleting them.
Texts are cheaper to send in bulk, and the toll-road wave alone produced more than 2,000 FBI complaints in about five weeks. The documented cases tell a different story: this library holds 27 vishing cases and 13 smishing cases. A case count reflects what gets investigated and written up, not how often each attack is tried. See the library statistics for current counts.
Reviewed by SEE Team. Last reviewed 21 Oct 2026. How pages are researched and fact-checked. About Social Engineering Examples.
Social Engineering Examples