What are smishing and vishing?

They are phishing by other channels. Smishing uses text messages, often about parcels, banks, tax refunds or a blocked account, with a link to a fake login page. Vishing uses voice calls: someone poses as IT support, the bank, a supplier or a manager and talks the person into reading out a code, installing a remote-support tool or approving a payment. Vishing has become a common way into companies because a convincing caller can get past controls that stop e-mail, for example by asking the help desk to reset an employee's password or register a new MFA device. Useful defences: a rule that IT never asks for passwords or codes by phone, a help-desk procedure that verifies identity before any reset, and the habit of calling back on a known number. A network sensor cannot hear calls, but it does show the new outside services a device starts talking to afterwards.

← All 29 questions on Phishing and e-mail aftermathAll topics