Phishing vs. Smishing vs. Vishing vs. Quishing: What's the Difference?

Ask people in the same company to define phishing, and the answers may drift. At least one will use the word as a catch-all for anything suspicious that reaches an inbox, and someone else will apply it to a phone call.

That drift can have operational consequences. A ticket labeled phishing that was actually a spoofed call to the help desk may be routed to the wrong queue, trigger an inappropriate playbook, or distort the metrics used to plan future controls.

Four Terms, One Underlying Technique

All four sit under social engineering. The attacker often relies on persuasion to get someone to take an unsafe action, while the campaign may also use technical infrastructure such as spoofed sender details, credential-harvesting pages, or malicious payloads.

What changes is the delivery channel: email, text message, phone call, QR code. The pretext underneath tends to come from the same small set of stories. An unpaid invoice, a locked account, a failed delivery, an urgent request from someone senior who happens to be in a meeting and can't take a call.

So the taxonomy isn't merely academic. The channel can affect what telemetry exists, which team owns the alert, and how the response is handled.

But what is a phishing attack beneath those channel labels?

Email Phishing Still Sets the Baseline

Email phishing typically asks the recipient to click, open an attachment, or type credentials into a page that looks familiar enough. The reporting volume reflects how dominant it remains. The FBI's Internet Crime Complaint Center logged more than a million complaints in 2025, with phishing/spoofing among the most frequently reported complaint types.

That figure carries two caveats. The FBI reports phishing and spoofing as a combined complaint category, which illustrates how closely the two can overlap in reported incidents, and complaint totals only capture what someone noticed and then bothered to report.

Email is often the channel with the most mature security instrumentation behind it. Gateways, DMARC, SPF and DKIM, sandboxing, link rewriting, a report button wired into the mail client. Detection, reporting and triage each have somewhere to live.

Attackers can exploit those differences when security coverage varies across channels.

Smishing Moves the Bait to SMS

Smishing is phishing delivered over SMS or a messaging app. The shorter format can remove some of the visual cues people may use to assess suspicious email, such as a familiar letterhead, sender details, or a signature block.

Mobile interfaces can make URL inspection and verification less convenient, particularly when users are working from small screens or embedded previews. Text messages can also feel more immediate or personal than conventional email, which attackers may exploit.

The harder question for operations is ownership. A suspicious text may have no equivalent reporting button or centralized gateway log, so in some organizations it reaches the security team as a screenshot or forwarded message, leaving analysts to reconstruct the details manually.

Vishing Puts a Live Voice Behind the Pressure

Vishing runs over phone calls and voicemail. An attacker rings a help desk or front office and steers the conversation toward a password reset, an MFA approval, or a change to payment details.

One advantage for the attacker is the ability to adapt in real time. A phishing email cannot respond to the recipient in real time, while a caller can react to hesitation, introduce information gathered about the target, and continue the conversation until the person feels pressured to comply.

Synthetic audio sharpened that further. The same FBI report included a dedicated section on AI-related cybercrime, covering 22,364 complaints and describing the use of voice cloning alongside fake profiles and fabricated documents.

This is also a channel where attackers may target a function, such as a help desk or finance team, rather than a single individual. Service desk verification procedure, callback policy, and what an agent is permitted to do under pressure become part of the detection and response control. Many ticket systems have no dedicated field for any of it.

Quishing Hides the Destination Inside an Image

Quishing uses a QR code to direct the target to a website or other destination instead of presenting the destination as an ordinary clickable link. The URL is still there, but encoded inside a QR code rather than presented as visible text.

The scan commonly happens on a phone, which shifts where the security boundary sits. If the scan happens on a personal device, security controls protecting the corporate laptop may have limited visibility into what happens next.

The FTC recently warned about a scam that combines text messaging with a QR code. A text message arrives carrying a QR code about an unpaid traffic violation, complete with a state seal, a fabricated case number and a hearing date, and scanning it can lead to requests for personal or payment information, malware downloads, or theft of money.

Smishing or quishing? Both. That overlap is exactly what makes single-label incident tagging fragile.

Where the Labels Get Used

The chain that matters runs detection, reporting, triage, ownership, response, control. Every step depends on people applying the same term to the same event.

That's the practical case for keeping a reference on hand instead of assuming agreement. A maintained glossary that sets a baseline definition, then defines smishing, vishing, quishing, spoofing and BEC against it, gives staff one place to check rather than five conflicting answers from five colleagues.

Tagging accuracy feeds everything downstream. If a meaningful share of tickets in the email bucket started with a phone call, the metrics steering next quarter's training and tooling budget are describing something that never happened.

Where the Categories Overlap

Real campaigns rarely stay on one channel. A familiar pattern: the email lands, then a call follows a few minutes later to confirm it. The call does the persuading, the email supplies the credibility.

Sitting on top of the channel are the targeting terms, which describe something else entirely. Spear phishing means the message wastailored to a specific role. Whaling means the target sits near the top of the org chart.

Business email compromise describes a fraud scheme in which attackers impersonate or compromise trusted business communications to obtain payments, data, or other actions. It can involve more than one channel, particularly when an attacker combines impersonation with another social-engineering technique.

A single incident might involve spear phishing delivered by SMS and also form part of a broader BEC scheme. Multiple labels can describe the same incident, with each highlighting a different aspect of the attack.

Controls That Don't Depend on the Channel

Channel-specific defenses earn their place. The durable ones sit underneath, though.

• Phishing-resistant MFA. Makes stolen passwords substantially less useful by requiring an authentication method resistant to common credential-phishing techniques.
• An out-of-band verification rule for anything touching money or access. The FTC's guidance on the traffic-notice scam is the general principle: confirm through a number or site already known to be legitimate, never one supplied by the message itself.
• A reporting path that covers all four channels. Plenty of organizations have a report button in the mail client and nothing equivalent for a suspicious call or text.
• Simulation and training that includes text, voice and QR, not just the inbox.

None of this depends on memorizing four similar-sounding terms. But shorthand only helps when everyone reaches for the same shorthand, and the ticket queue is usually where that falls apart first.