# Smishing and Vishing The two off-email cousins of phishing. **Smishing** (SMS + phishing) delivers the lure by text message; **vishing** (voice + phishing) delivers it by phone call. Both are forms of *social engineering* — manipulating a person rather than a machine — and both exploit a simple asymmetry: people have learned to be wary of suspicious emails but still extend reflexive trust to a text from "their bank" or a phone call from "the IRS," "Microsoft support," or "a company executive." The channel change is the whole trick. ## Smishing A smishing text impersonates a trusted sender — a bank, a delivery service ("your package is held, confirm your address"), a toll authority, a government agency — and pushes the target toward a malicious link or a phone callback. Texting strips away most of the cues people use to spot fraud (no sender domain to inspect, link-shorteners hiding the real URL, and a medium associated with quick, casual replies). Smishing is frequently paired with [[Typosquatting]]-style look-alike domains as the landing page. ## Vishing A vishing call uses a human (or, now, a machine) voice to extract credentials, payment, or one-time passcodes in real time, often manufacturing urgency ("we've detected fraud on your account; read me the code we just sent"). Caller-ID spoofing makes the call appear to come from a legitimate number. Vishing is also the human end of a [[SIM Swapping]] operation and is a common way to talk a target or a help-desk worker into surrendering the codes that defeat two-factor authentication. ## The AI-voice escalation The dangerous new development is **AI voice cloning**. Modern speech models can reproduce a specific person's voice from only seconds of sample audio (easily scraped from videos, voicemails, or earnings calls), and the output has crossed the threshold where an average listener cannot reliably tell it from the real voice — the audio counterpart to video [[Deep Fakes]]. Reported AI-driven vishing rose several-fold across 2024, and a single deepfake-voice-and-video conference-call scam cost the engineering firm Arup roughly **$25 million** in May 2024. This collapses the gap between mass-market vishing and the precision of [[Spearphishing]]: an attacker can now sound exactly like a named CEO, relative, or official. ## Right-wing-KB relevance Smishing and vishing matter to this knowledge base as the **retail delivery layer** for the larger threats it tracks — the way credentials, 2FA codes, and account access are actually pried loose from individual targets, including campaign staff, officials, journalists, and executives. The AI-voice turn ties the cybersecurity story directly to the vault's [[Deep Fakes]] and synthetic-media coverage: the same generative tools powering political disinformation also supercharge financial and credential fraud, and erode the baseline trust that a familiar voice on the phone is who it claims to be. ## Distinct from neighbors - **Phishing (email)** — the parent technique; smishing and vishing just change the channel to SMS and voice. - **[[Spearphishing]]** — *targeted* phishing using personal detail; AI-voice vishing is effectively spearphishing for the phone. - **[[SIM Swapping]]** — hijacks the phone *number itself*; vishing is the persuasion that often enables or accompanies it. - **Quishing** — the QR-code variant; same family, different delivery surface. ## See Also - [[Cybersecurity Lexicon]] - [[Spearphishing]] - [[SIM Swapping]] - [[Deep Fakes]] - [[Typosquatting]]