Phishing, smishing, and vishing all aim to do the same thing — get you to reveal information, send money, click a link, or take some other action that benefits a fraudster. The only real difference is the channel: phishing is email, smishing is text message, vishing is a phone call. They're some of the most common fraud tactics because they're cheap to run and can reach huge numbers of people at once.
How these scams work
You receive a message that looks genuine — claiming to be from a bank, Xe, a government agency, a delivery company, a tech company, or an employer — designed to get an immediate reaction. It usually asks you to click a link, enter your credentials, provide a verification code, download software, or transfer money.
Why they work
They lean on ordinary human responses: urgency, authority, security concerns, curiosity, fear. Fraudsters design these messages carefully, specifically to trigger one of those reactions before you've had time to think it through.
Common examples
Security warning
Claiming your account is at risk.
Delivery issue
Claiming a parcel couldn't be delivered.
Refund opportunity
Claiming you're owed money.
Verification request
Claiming your information needs confirming right now.
How to protect yourself
Pause before you act. Verify independently, using official websites and apps rather than the links in the message itself. If something feels off, contact the organisation using details you found yourself, not ones supplied in the message.
If you clicked a link
- Secure your accounts
- Change your passwords
- Review your activity
- Save any evidence
- Get help if you need it
Key takeaway
The safest response to an unexpected message isn't immediate action — it's independent verification.
Received a suspicious email, text, or call? When you contact us, use our Help Centre.