On Tuesday, it was an email. A woman in Ohio — call her Dana (a composite drawn from real reported cases, not one real person) — got a message that looked like it came from her bank: an unusual sign-in attempt, a button to secure her account. On Thursday, it was a phone call, and the caller ID showed her bank’s real number. On Saturday, a text told her a package was stuck at a depot and she owed a $1.99 redelivery fee. Three messages, three different channels, one week. Dana had just run into all three types of scams that now do most of the damage online — and she nearly fell for the third one, because the first two had already left her rattled and second-guessing everything.
Her week is not unusual. Phishing and spoofing drew 193,407 complaints to the FBI’s Internet Crime Complaint Center (IC3) in 2024 — more than any other crime type the bureau tracks. Text-message scams alone cost people a reported $470 million that same year, according to the Federal Trade Commission, five times the amount reported in 2020. The costumes keep changing. The trick underneath them does not.
The three names sound like tech jargon, but each one is just the word “phishing” adjusted for how the message reaches you. Learn to tell them apart and you learn where the trap sits inside each one — which is usually all it takes to step around it.
The three types of scams at a glance
The short answer: Phishing reaches you by email. Vishing reaches you by phone call. Smishing reaches you by text message. Different doors, same thief: every one of them impersonates an organization you trust and rushes you into handing over money, passwords, or personal information before you stop and check.
Phishing: the trap in your inbox
The FBI describes phishing as scams designed to trick you into giving information to criminals that they have no right to have. Email is the original channel, and it is still the busiest one — phishing and spoofing together were the single most-reported crime type to the IC3 in 2024.
Here is how a typical phishing attack unfolds:
- An email arrives that appears to come from a business you actually use — a bank, a retailer, your employer. The sender’s address has been spoofed, often changed by a single letter.
- The message gives you a reason to act fast: a suspicious charge, a locked account, a payment that failed.
- It directs you to a website that looks nearly identical to the real one and asks you to sign in or “verify” your details. Some versions skip the website and attach a file instead; opening it installs malware.
- Whatever you type — password, card number, PIN — goes straight to the criminal, who uses it or sells it on.
The classic version goes like this: an email warns that your account will be closed unless you update your information today. The link opens a page with your bank’s logo, colors, and login boxes, matched almost pixel for pixel. The only thing wrong with it is the web address — and that is the one thing most people never check.
Red flags to look for:
- A sender address that is close to the real one but not exact
- A generic greeting like “Dear customer” from a company that knows your name
- Threats and deadlines — act now or lose the account
- A link whose real destination does not match the company it claims to be from
- An attachment you were not expecting
- Any request for a password or PIN; as the FBI points out, companies generally don’t contact you to ask for your username or password
Our guide to the red flags of phishing emails walks through real examples line by line, so you can practice spotting them before a real one lands in your inbox.
Vishing: the trap in the phone call
Vishing is phishing by voice. The FBI defines it plainly: vishing scams happen over the phone, voice email, or VoIP calls. There is no link to inspect and no sender address to check — just a voice, a story, and a clock ticking in your ear. For many people, that makes it the hardest of the three to resist.
Here is how a vishing call usually runs:
- Your phone rings, and the caller ID shows a number you recognize — your bank’s real number, a government agency, a well-known tech company. That display means nothing. Spoofing software lets callers print any number they like on your screen.
- A calm, professional voice explains the problem: fraud detected on your account, a legal matter, a virus on your computer.
- The fix, they say, has to happen right now, on this call — move your money somewhere “safe,” read out the security code that just arrived by text, or settle a fee with gift cards or a wire transfer.
- The moment you comply, the money is gone. A real bank will never ask you to move money to protect it, and no legitimate agent needs you to read them a one-time code.
One common script: the “fraud department” calls about a charge you do not recognize. They offer to stop it — they just need you to confirm the one-time code that was sent to your phone. That code is the key to your real account. Read it out, and you have held the door open while they walk in.
Red flags to listen for:
- Caller ID treated as proof — numbers can be faked in seconds
- Instructions to keep the call secret, or warnings not to hang up and check
- Pressure to move money into a “safe” or “protected” account
- Payment demanded in gift cards, wire transfers, or cryptocurrency
- A request to read out a one-time code — that code is meant for your eyes only
- Threats of arrest or legal action from an agency supposedly settling matters by phone
Our vishing explainer goes deeper on the scripts callers use and exactly what to say — and not say — when one reaches you: what is vishing and how voice phishing works.
Smishing: the trap in your texts
Smishing is phishing by SMS — the text-message version. The FBI groups it with phishing and spoofing, and the FTC’s numbers show why it deserves its own name: people reported losing $470 million to scams that started with a text in 2024, and the share of text-scam reports involving a loss climbed to 11% that year. Texts get read within minutes, and most of us read them on the move, half-distracted. Scammers know it.
Here is how a smishing attack typically works:
- A text arrives from what looks like a delivery company, your bank, a toll agency — or just an unfamiliar number.
- It names a small, believable problem: a package is held up, a toll went unpaid, an account alert needs confirming.
- The link opens a cloned website — same logos, same layout as the real thing — with a short form on it.
- The form harvests your card details or personal information. The $1.99 fee was never the prize. Your card number was.
Fake package delivery messages were the most reported text scam of 2024, according to the FTC. Together, five types — delivery problems, fake job offers, fake bank fraud alerts, unpaid toll notices, and friendly “wrong number” texts that turn into something else — accounted for about half of all text fraud reported that year.
Red flags to watch for:
- A delivery text you were not expecting, especially one carrying a link
- A tiny fee request; small amounts are bait, not the theft itself
- A sender number that looks odd, or a message thread with no history
- Sudden urgency about a toll, fine, or charge you have never heard of
- A cheerful “wrong number” text that keeps the conversation going — that is a setup, not a coincidence
Before you delete a suspicious text, forward it to 7726 (SPAM). It takes seconds and helps your carrier block the next batch. Our smishing guide covers the most common fake bank and delivery texts making the rounds right now.
The three types of scams, side by side
| Type | Channel | Example message | First thing to check |
|---|---|---|---|
| Phishing | “Your account has been limited. Verify your password to restore access.” | The sender’s real email address — and where the link actually leads | |
| Vishing | Phone call or voicemail | “This is your bank’s fraud team. Read back the security code we just texted you.” | Nothing on the call itself. Hang up and dial the number printed on your card. |
| Smishing | Text message (SMS) | “Your package is on hold. Pay the $1.99 redelivery fee to release it:” | Whether you are expecting a delivery at all — then type the carrier’s real address yourself instead of tapping the link |
The one rule that defeats all three
Never act inside the message that reached you. That is the whole rule.
Do not tap the link in the email. Do not call back the number in the voicemail. Do not reply to the text. Instead, start a fresh conversation through a channel you chose yourself: open your bank’s app, type the company’s web address into your browser by hand, or call the number on the back of your card.
Why does one rule cover all three? Because every version of this scam depends on the criminal controlling two things — the channel and the clock. The fake website, the spoofed caller ID, the deadline breathing down your neck: all of them live inside the message the scammer sent. The moment you step out of that message and make contact on your own terms, the script collapses. A real bank, agency, or delivery company can be reached another way, and they will tell you within seconds whether anything was ever wrong. Verifying takes under a minute. It is also the step nearly every victim skips, because the message was engineered to make stopping feel like the risky choice. It never is.
If you already clicked, answered, or paid
Act quickly, in this order:
- Call your bank using the number on your card. Ask them to freeze the card and flag recent activity.
- Change the password on the affected account from a different, clean device, and turn on two-factor authentication.
- Forward the text or keep the email — evidence helps. Forward scam texts to 7726.
- Report it to the FTC at ReportFraud.ftc.gov and to the FBI’s IC3 at ic3.gov. Reports are how these operations get found and shut down.
Sources
- FBI — Spoofing and Phishing: https://www.fbi.gov/how-we-can-help-you/scams-and-safety/common-frauds-and-scams/spoofing-and-phishing
- FBI Internet Crime Complaint Center — 2024 Internet Crime Report: https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf
- Federal Trade Commission — Top Text Scams of 2024 (Data Spotlight, April 2025): https://www.ftc.gov/news-events/data-visualizations/data-spotlight/2025/04/top-text-scams-2024
- Federal Trade Commission — How to Recognize and Avoid Phishing Scams: https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams
- Federal Trade Commission — How to Recognize and Report Spam Text Messages: https://consumer.ftc.gov/articles/how-recognize-and-report-spam-text-messages
Last reviewed: November 2026
This article is for education only and is not financial or legal advice.