Nowadays, cyber criminals don’t just try to exploit the vulnerabilities in your organization’s IT or security systems. Instead, they target the people who use them through social engineering techniques designed to deceive them into revealing confidential or sensitive information.  

Social engineering tactics have evolved over time as new technologies emerge. So, let’s look at the difference between smishing, vishing, and phishing, three techniques commonly used by cyber criminals, to ensure you know what to look for to reduce the chance of falling victim to one of these attacks. 

What is phishing? 

Phishing attacks typically involve deceptive emails or website links that impersonate a legitimate source to prompt people to voluntarily hand over sensitive information, such as passwords and credit card numbers. They can also originate from real accounts that have been compromised. 

There are several kinds of phishing attacks, including: 

• Email Phishing: Mass messages sent with fraudulent links or attachments included.  
• Spear Phishing or Whaling: Customized emails targeting specific individuals or organizations.  
• Clone Phishing: The duplication of a legitimate email sent with the addition of malicious content. 

What are some indicators of a phishing attempt? 

When receiving email communications requesting sensitive information or an unusual urgent action, it’s important to consider the content of the email, as phishing attacks can often be identified through: 

• Misspelled URLs, words, or email addresses 
• An urgent tone demanding immediate action 
• An unusual sender email address that doesn’t match the name of the sender
• URL obfuscation through link shorteners (bit.ly/) or QR codes (also known as Quishing)
• Attachments with links to click 

What can be done to prevent a phishing attempt from being successful?  

Failing to recognize a phishing attempt for what it is can ultimately result in a data breach, identity theft, financial loss, and/or damage to your and your organization’s reputation, so knowing what to look for is the first step to stopping one in its tracks. In addition to remaining vigilant, whenever receiving a suspicious email communication, you should also: 

• Verify the sender’s email address before responding or clicking on any included links 
• Avoid clicking on suspicious links or downloading any attachments 
• Enable multi-factor authentication for any online accounts 

What is smishing? 

Smishing scams use targeted SMS or text messages that often appear to be from trusted sources to convince people to click links that install malware on their devices or prompt them to enter personal information. 

Attackers commonly use smishing techniques such as: 

• SMS-based Smishing: Deceptive text messages with links to fraudulent websites. 
• Fraudulent URL Smishing: Texts including misleading URLs designed to appear legitimate. 

What are some indicators of a smishing attempt? 

Since they originate through text or SMS messages, there are different signs that indicate you’ve been the target of a smishing attempt. Some things to look out for include: 

• Unsolicited messages that request your sensitive information 
• Messages that contain an urgent call to action (e.g., Your bank account has been compromised. Update your password now!) 
• Suspicious sender phone numbers or unfamiliar contacts 
• Content related to recent news headlines (e.g., Support disaster relief.)

What can be done to prevent a smishing attempt from being successful? 

Like phishing attacks, falling victim to a smishing attack can result in detrimental consequences, such as identity theft, financial fraud, and unauthorized account access. To protect yourself from smishing attempts, you should: 

• Avoid clicking on links in messages from unknown numbers 
• Be cautious when sharing personal information over text 
• Regularly update your devices and applications to patch vulnerabilities 
• Forward suspicious messages to your provider at SPAM (7726)

For more ways to protect yourself and your mobile devices, check out our Best Practices for Mobile Device Management and Protection.  

What is vishing? 

Vishing scams utilize targeted phone calls and often appear to originate from a trusted source to convince people to reveal sensitive information such as credit card information or their Social Security number. 

Common vishing methods include: 

• Caller ID Spoofing: Caller ID information is faked to appear legitimate  
• Trusted Caller Impersonation Vishing: Calls from sources pretending to be from a bank, government agency, tech support, other trusted organization, or loved one

What are some indicators of a vishing attempt? 

Since vishing attempts originate through the phone, it can be difficult to discern if the call is legitimate or not if you’re not sure what to look for or anticipate. When wondering if a phone call could be a potential vishing attempt, you should be on the lookout for the following warning signs: 

• Unsolicited requests for personal or financial details 
• Urgent request for immediate action or payments 
• The caller pressuring you to reveal sensitive information 

What can be done to prevent a vishing attempt from being successful? 

The consequences of a successful vishing attempt are the same as that of a successful smishing attempt, so it’s important to take preventative measures to protect yourself and your data. You can do this by: 

• Validating the caller’s identity before sharing any information 
• Refraining from sharing sensitive data over the phone – ever 
• Implementing call screening and verification procedures such as calling them back on a known number

Catch Attacks Before They Slip Through the Cracks 

At SUCCESS, we help train your team on what to look for to make sure everyone is doing their part to keep your data safe. After all, the first line of defense is a well-informed and vigilant team. Contact us to get started on your journey to a more secure IT infrastructure.