Fishing, smishing, and vishing explained

Phishing is a cyberattack method that uses fraudulent emails to deceive recipients into taking actions that may compromise their security.² (external link) 

Criminals send messages that may appear to come from legitimate sources, such as banks, suppliers, government agencies, or even colleagues. Their aim may be to steal sensitive information, install malware, or trick victims into making payments to fraudulent accounts.

How to spot a phishing attack

Recognising phishing attempts can require vigilance and awareness of common tactics. There are certain red flags to look out for, such as: 

• Suspicious sender addresses. Phishing emails often use addresses that closely mimic legitimate ones, with subtle misspellings or different domain extensions. 
• Generic greetings. Legitimate organisations typically address you by name. Phishing emails often use impersonal greetings, such as ‘Dear Customer’ or ‘Valued Client’. Urgent or threatening language. Messages claiming your account will be suspended, warning of unauthorised activity, or demanding immediate payment are strong indicators of phishing attempts. 
• Requests for sensitive information. No legitimate organisation will ask you to provide passwords, PINs, or full account details via email. 
• Suspicious links and attachments. Hover over links without clicking to reveal the actual destination URL. Phishing emails often contain links that don't match the purported sender's website. 
• Poor spelling and grammar. Some sophisticated phishing campaigns can be well written, but many contain errors in spelling, grammar, or formatting that legitimate business communications typically would not.³ (external link)

Smishing (a combination of ‘SMS’ and ‘phishing’) is a cyberattack method that uses text messages to deceive victims.⁴ (external link) 

Like email phishing, smishing messages impersonate trusted organisations to trick recipients into revealing sensitive information, clicking malicious links, or making payments to fraudsters. 

SMS communications can feel more personal and immediate than email, and mobile phone screens can make it harder to scrutinise sender details or link destinations. Criminals exploit these factors to increase their success.

How to spot a smishing attack

Recognising smishing attempts often requires the same critical thinking applied to email phishing, but adapted for the SMS format: 

• Unexpected messages. Be suspicious of unsolicited texts claiming to be from your bank, delivery companies, government agencies, or other organisations, especially if you're not expecting them. 
• Urgency and pressure. Smishing messages often create a false sense of urgency, claiming that your account has been suspended, a payment has failed, or you'll lose an opportunity if you don't act immediately. 
• Suspicious links. Never click links in unexpected messages. Instead, navigate directly to the alleged organisation's website or contact them through verified channels. 
• Requests for action. Messages asking you to confirm account details, verify payments, or update information should trigger suspicion. 
• Impersonation of trusted brands. Delivery companies, banks, and government agencies are often impersonated because recipients are likely to have relationships with these organisations. 

If you receive a suspicious text message, you can report it for free by forwarding it to 7726 (external link). This service, provided by UK mobile networks, helps identify and block smishing campaigns.

Vishing (‘voice phishing’) uses telephone calls to deceive victims into revealing sensitive information or making payments.⁵ (external link) Unlike phishing and smishing, which rely on written communication, vishing uses the immediacy and personal nature of voice conversation to build trust and influence decision-making.⁶ (external link) 

Vishing attacks can be sophisticated, with criminals using information from social media, data breaches, or company websites to make their calls appear legitimate. They may know your name, your bank, your employer, or other details about you. Some criminals use technology to trigger a recognised caller ID, making it appear that they're calling from a genuine organisation.⁷ (external link) 

The real-time nature of phone conversations can create pressure to respond immediately, while the vocal element allows criminals to use tone, emotion, and social tactics that don’t always translate to written forms of communication.

How to spot a vishing attack

Recognising common tactics and being appropriately sceptical during unexpected phone calls can help protect you against vishing: 

• Bank impersonation. One common vishing scenario involves criminals claiming to be from your bank, warning you of suspicious transactions or security breaches. They may ask you to verify account details, provide PIN numbers, or transfer money to a ‘safe account’. 
• Tech support scams. Many criminals claim to be from well-known technology companies, warning that your computer has viruses or security problems. They may request access, which they use to install actual malware or steal information. 
• HMRC and government impersonation. Scammers may pose as tax authorities or other government agencies, threatening legal action, arrest, or fines unless immediate payment is made. 
• Pressure and urgency. Criminals may claim your account will be closed, you'll face legal action or miss a critical opportunity unless you act immediately. 
• Requests for remote access. If you receive an unsolicited call requesting remote access to your computer or mobile device, this is usually a strong indicator of potential fraud. 
• Caller ID spoofing. Criminals can manipulate your phone’s caller ID to display numbers that appear to belong to banks, government agencies, or other trusted organisations. 

If you receive a suspicious call, it’s usually best to end the call promptly. If the caller claims to be from a legitimate organisation, you can verify legitimacy by contacting that organisation directly. Check their official website or documentation for a phone number and avoid using any contact information provided by the suspicious caller.

Protecting your business from these threats typically involves a comprehensive approach that encompasses technological measures, employee training, and strong security policies. While no approach can guarantee complete protection, implementing a combined defence can help make your business less vulnerable.

1. Educate employees

Your employees are often your first line of defence against social engineering attacks. Some steps you can take to help prepare them for attacks include: 

• Arranging cybersecurity awareness training 
• Conducting simulated phishing tests 
• Creating a security-conscious culture 
• Providing clear reporting procedures

2. Use multifactor authentication

Multifactor authentication (MFA) requires additional verification beyond a username and password. Even if criminals obtain employee login information, they can’t access accounts without the second authentication factor. Businesses can: 

• Implement MFA across all critical systems. 
• Choose robust authentication methods. 
• Educate users about MFA fatigue attacks.

3. Secure your communication channels

Technical measures can catch some attacks before they reach employees, providing an essential safety net for your business: 

• Deploy email filtering and anti-spam software. 
• Implement SMS and call verification protocols. 
• Use email authentication protocols. 
• Maintain up-to-date security software. 

Understanding how to prevent hacking provides additional context for protecting your business from these and other cyber threats.

Despite your best efforts, your business may still be targeted by phishing, smishing, or vishing attacks. Responding quickly and appropriately can help limit the damage if an attack is successful.

1. Alert your security teams

If you suspect a successful phishing, smishing, or vishing attack has compromised your systems, contact your IT security team or external security provider immediately: 

• Conduct security scans. Run malware and virus scans on any potentially compromised systems immediately, before the attack can spread to other systems or data can be extracted. 
• Isolate affected systems. If specific devices or accounts have been compromised, disconnect them from your network to prevent the spread of malware and other threats. 
• Engage external specialists if needed. For small businesses without dedicated security teams, consider engaging cybersecurity specialists who can analyse the threat and help provide a solution.

2. Change your passwords

Compromised credentials may provide criminals with access to your systems and data. Changing passwords promptly is important to reduce risk. 

• Reset potentially compromised passwords. Change passwords for the affected account and any other accounts using the same or similar credentials. 
• Use strong, unique passwords. When resetting passwords, ensure new credentials are complex, unique, and not related to previously used passwords. 
• Review password policies. Use the incident as an opportunity to strengthen your business’s password policies.

3. Report a breach

Reporting attacks can help the authorities track criminal activities and may prevent others from falling victim to the same scams: 

• Report to the National Cyber Security Centre. Forward suspicious emails to [email protected] or report them through the NCSC website (external link). 
• Report to Action Fraud. For incidents involving financial loss or where you've provided personal information, report to Action Fraud (external link), the UK's national fraud and cybercrime reporting centre. 
• Report SMS scams. Forward suspicious text messages to 7726 (which spells SPAM on a phone keypad). This free service helps mobile networks identify and block smishing campaigns. 
• Consider regulatory notifications. Depending on the nature and extent of the breach, you may have a legal obligation to notify the Information Commissioner's Office (ICO) (external link) and affected individuals. 

Understanding cybersecurity risks facing small businesses can help you respond appropriately to incidents.

4. Inform employees

Transparent communication with your employees helps ensure that everyone understands the potential threats posed by phishing, smishing, and vishing attacks. 

• Alert all employees promptly. If credentials or systems have been compromised, employees should be informed promptly so they can be vigilant for unusual activity or messages. 
• Provide clear guidance. For example, if criminals are impersonating your finance director and requesting bank transfers, ensure everyone knows to verify such requests through secondary channels. 
• Update security procedures if needed. If the attack revealed gaps in your security processes, update your procedures and communicate the changes to your employees.