Smishing and vishing
Types of smishing and vishing, and how to spot them.
Smishing is phishing by text message, vishing is phishing by phone call, and quishing hides the link in a QR code. Here's what they look like, how they work together and how organisations get the sites and fake numbers behind them taken down.
What are smishing and vishing?
Phishing by text, call and QR code.
Smishing uses text messages, vishing uses phone calls and quishing hides a malicious link inside a QR code. They often work together: a text tells someone to call a number, or a caller sends a link while they're still on the line. Each one borrows a trusted name so people act before they check.
In the data
What smishing and vishing look like right now.
Patterns from the phone-only phishing sites and fake support numbers we handled for our clients in the first half of 2026.
Warning signs
How to spot a fake text or call.
FAQ
Smishing and vishing questions, answered.
What are smishing and vishing?
Smishing is phishing by text message: a fake alert or offer with a link to a site that steals logins, codes or card details. Vishing is phishing by phone call: someone pretends to be a bank, airline, retailer or government agency to get the same information by talking. Both usually borrow a trusted brand's name.
What is quishing?
Quishing is phishing through a QR code. The code hides the web address until it's scanned, then opens a fake payment, parking, login or reward page. QR codes turn up on stickers placed over real ones, in emails, on letters and on posters.
Why do scam texts appear in the same thread as real messages?
Many texts are sent with a name instead of a number, and that name can be spoofed. If a scammer uses the same sender name as a real brand, the phone may group the fake message with genuine ones. Being in the same thread isn't proof a message is real.
How can I tell if a call is really from my bank or provider?
Hang up and call back on the number on your card, statement or the provider's own website. Real organisations won't ask you to read out a one-time code, approve a login, move money to a "safe account" or install a remote access app. Caller ID can be faked, so a familiar number isn't proof.
Can fake numbers and smishing sites be taken down?
Yes. The sites that texts link to can be reported to hosts and registrars, and fake numbers can be removed from the pages, documents, ads and posts that carry them. How long it takes depends on the provider and the case. In the first half of 2026, 98% of the phone-only phishing sites and 92% of the fake support numbers we pursued were confirmed removed.
What should we do if customers are getting fake texts or calls in our name?
Collect screenshots of the texts, the links and any numbers being used, then report the sites and numbers, or request a takedown and our team will check them and handle the reports. Warn customers about what the messages look like, remind them how you really contact them, and brief your support team.
How can organisations reduce smishing and vishing?
Tell customers clearly what you will and won't ask for by text or phone, keep links out of your own texts where you can, and watch for lookalike domains, phone-only sites and fake support numbers using your name so they can be removed quickly.
Found a fake text, number or site using your brand?
Send us the link and our team will check it and talk you through taking it down. Or book a demo to see how we find them first.