12 November 2026 • Phishing
In brief: Vishing is phishing by phone call or voice message. Smishing is phishing by SMS or chat app. Both work because a phone feels personal: no link to hover over, no spam filter, little time to think. Below are six calls and six texts, each with sample wording, the method and the warning signs. The pattern never changes: someone you did not contact wants a code, a login or a payment, now.
New to the terms? Start with what is vishing and what is smishing. Every script below is a sample we wrote, with made-up names and placeholders such as [your bank].
Why phone-based phishing keeps growing
The APWG saw vishing rise by 20% and smishing by 40% in the second quarter of 2026. CrowdStrike measured a 442% increase in vishing between the first and second half of 2024. In Verizon’s 2026 Data Breach Investigations Report, the median click rate was 2% in phone-based simulations, against 1.4% in email.
The 12 examples at a glance
| # | Example | Imitates | Wants | Key warning sign | What to do |
|---|---|---|---|---|---|
| 1 | Helpdesk call | Your IT support | Your MFA code | Asks you to read out a code | Call the helpdesk yourself |
| 2 | Fraud desk call | [Your bank] | A transfer | A “safe account” | Call the number on your card |
| 3 | CEO voice message | Your director | A secret payment | Secrecy, unknown number | Ask a question only he can answer |
| 4 | Supplier call | A known supplier | Your next payment | New bank account by phone | Call the contact in your records |
| 5 | Tech support call | A software vendor | Remote access | They call you | Hang up, tell IT |
| 6 | Callback invoice | A subscription service | That you call them | Only a phone number | Check the account yourself |
| 7 | Parcel text | A carrier | Card details | Small fee, odd link | Use the carrier’s app |
| 8 | Bank text | [Your bank] | Your banking login | A link to “renew” | Open the banking app yourself |
| 9 | Tax text | The government | A payment or login | Threat of seizure | Log in to the official portal |
| 10 | “Hi mum” | Your child | An urgent transfer | New number, cannot call | Call the old number |
| 11 | Account alert | Your company’s IT | Password and MFA code | Lookalike domain | Use your bookmark |
| 12 | Gift card text | Your manager | Gift card codes | Secrecy, new number | Call your manager |
6 vishing examples
1. The IT helpdesk that needs your MFA code
What you hear: “This is Daniel from the IT service desk. We see failed sign-ins on your account. I am sending a code. Can you read it back?”
How it works: the caller has your password and needs the second factor. Retool was breached this way on 27 August 2023: one code, read out to a deepfaked “IT” voice, opened 27 customer accounts. In 2025 Google described a group that phones employees as IT support to reach Salesforce data, and was hit itself.
Spot and stop: a code you did not request. Hang up and call the helpdesk on the internal number.
2. The bank’s fraud desk
What you hear: “This is the fraud department of [your bank]. We blocked a payment of €1,950. I will help you move the balance to a safe account.”
How it works: the number on your screen is spoofed. Fake helpdesks were the fraud consumers reported most to the Dutch Fraudehelpdesk in 2025: 17,264 reports, against 9,492 in 2024.
Spot and stop: a “safe account” or remote-access software. Hang up and call the number on your card.
3. The voice message from the “CEO”
What you hear: “It’s Mark. I am about to board. We close an acquisition today and I need you to handle a confidential payment. Keep this between us.”
How it works: AI clones a voice from a webinar or podcast. In July 2024 a Ferrari executive got a call in CEO Benedetto Vigna’s voice about a secret deal, Bloomberg reported. He asked which book Vigna had just recommended. The caller hung up. See our CEO fraud examples and deepfake awareness training.
Spot and stop: an unknown number and secrecy. Ask a question only the real person can answer.
4. The supplier with a new bank account
What you hear: “This is Sophie from [supplier]. We switched banks. I will email the new account number. Could you update it before this month’s payment run?”
How it works: the call makes the follow-up email look expected. Your next invoice is paid to the attacker, and nobody notices until the supplier’s reminder arrives.
Spot and stop: bank details changed by phone. Call the contact in your own records and let a second person approve.
5. The tech support call
What you hear: “I am calling from the security team of [software vendor]. Your computer has been infected. Please sit down at your keyboard.”
How it works: you open a harmless system log as “proof” and then install remote-access software. From there the caller sees your passwords and the company network.
Spot and stop: vendors do not phone users about infections. Hang up and tell IT.
6. The callback number in an invoice email
What you read and hear: “Your subscription was renewed for €389.99. Not you? Call [number].” On the phone: “I only need to connect to your screen for the refund.”
How it works: no link, no attachment, so filters let the email through. You make the call yourself, which lowers your guard. The email side is in our overview of types of phishing attacks.
Spot and stop: a phone number as the only option. Do not call. Check the account on the vendor’s own site.
6 smishing examples
7. The parcel that could not be delivered
What you read: “[Carrier]: your parcel could not be delivered because €1.45 in shipping costs is unpaid. Pay within 24 hours: [link]”
How it works: everyone is expecting a parcel. The small fee is the bait; the page wants your card details.
Spot and stop: a fee after shipping, a link outside the carrier’s domain. Track the parcel in the carrier’s app.
8. The bank or payment app
What you read: “[Your bank]: your banking app registration expires today. Renew now: [link]”
How it works: the link opens a copy of the sign-in page. With your login and one code the attacker registers his own phone as your banking app. Example 2 often follows.
Spot and stop: a link in a text from a bank. Open the app yourself.
9. The tax authority or government portal
What you read: “[Tax authority]: your debt of €1,277 has not been paid. To prevent seizure, pay today via [link]”
How it works: fear of a fine does the work. Variants imitate the government login or promise a refund.
Spot and stop: a threat and a payment link in one text. Log in to the official portal yourself.
10. “Hi mum, hi dad”
What you read: “Hi mum, my phone broke, this is my new number. I have to pay a bill today and my banking app does not work yet.”
How it works: it targets employees as parents, usually in a chat app. It is the same trick as example 12: whoever knows it from home recognises it at work.
Spot and stop: a new number and a reason why calling is impossible. Call the old number.
11. The MFA or account alert
What you read: “[Company] IT: your password expires today. Sign in to keep your access: [company]-sso.example”
How it works: in 2022 Twilio employees received texts like this. Some signed in, and data of 209 customers was accessed. At Cloudflare 76 employees got the text and three entered their password. The attack failed because Cloudflare uses hardware security keys.
Spot and stop: a domain with the company name plus “sso” or “login”. Use your bookmark and report the text.
12. The boss who needs gift cards
What you read: “It’s Laura, new number. I am in a meeting. Can you buy five gift cards of €100 for a client and send me the codes?”
How it works: gift card codes are as good as cash and cannot be reversed.
Spot and stop: a new number, secrecy, gift cards. Call your manager or walk over.
Smishing vs vishing vs phishing
| Phishing | Smishing | Vishing | |
|---|---|---|---|
| Channel | SMS and chat apps | Call or voice message | |
| The ask | Click, open, sign in | Tap a link, reply, pay | Read out a code, pay, install software |
| First defence | Check sender and link | Open the app yourself | Hang up and call back |
The QR-code variant is called quishing.
How to verify a caller
- Take the pressure off. Say you will call back.
- Call back on a number you already have. Caller ID proves nothing: numbers can be spoofed.
- Never give a code, a password or remote access to someone who contacted you.
- Put a second person on money. Every changed bank account needs a colleague’s approval.
Your own service desk needs the same rules, because attackers also call in. The attackers of MGM Resorts claimed in 2023 that they phoned the help desk as an employee found on LinkedIn; MGM put the damage at about $100 million. Marks & Spencer was entered in April 2025 through a “sophisticated impersonation” of a third-party user, chairman Archie Norman told MPs, at an estimated cost of about £300 million. In February 2026 New York’s financial regulator warned about callers posing as IT help desk staff, and in April 2026 ADT confirmed a breach that the attackers say began with a vishing call. A rule nobody has practised does not survive a confident caller. That is what training is for.
Would your colleagues hang up, or read out the code?
Guardey trains every employee with a weekly gamified challenge of about three minutes, so spotting odd requests becomes a habit.
Discover security awareness trainingHow companies simulate vishing and smishing
Most organisations test email and nothing else. Those that go further send test texts to work phones and place scripted calls to the service desk, finance and HR. Three rules keep it fair: announce the programme, never punish anyone, and count reports as well as failures. Guardey includes phishing simulations and a weekly challenge with team competition, so employees keep practising between tests.
Frequently asked questions
What is the difference between smishing and vishing?
The channel. Smishing is a text or chat message. Vishing is a phone call or voice message. The goal is the same: your code, your login or your money.
What is an example of vishing?
A caller from “IT” who asks you to read out the code that just arrived on your phone. Examples 1 to 6 are vishing, 7 to 12 smishing.
Can I trust caller ID or the sender name of a text?
No. Both can be spoofed. Verify through a channel you choose yourself.
What should I do if I gave a code or paid?
Tell IT straight away and change your password. If you paid, call your bank on the official number. Report messages you only received too.
Curious who on your team would fall for example 1?
Try Guardey with your own colleagues: weekly three-minute challenges, phishing simulations and reporting per team.
Try Guardey free for 14 days
