In an increasingly connected world that depends on digital technologies, information security has become a priority for individuals and organisations. However, as technology has evolved, new cyber threats have also emerged that seek to exploit human and technological vulnerabilities. Among the most common techniques cybercriminals use to steal sensitive information and compromise data security are phishing, smishing and vishing. These forms of attack are particularly insidious because they rely on psychological manipulation and exploit victims’ trust and lack of awareness.
Phishing, smishing and vishing share the same goal: to trick people into revealing confidential information, such as passwords, credit card numbers or personal data. However, they differ in the methods and communication channels used to carry out the attacks. This article, aimed at users of document management platforms and information security professionals, explains how these threats work, the risks they pose and best practice for preventing them.
Phishing: The gateway to digital fraud
Phishing is a cyber attack technique based on sending fraudulent messages, usually by email, that appear to come from trustworthy sources. The aim is to trick the recipient into revealing sensitive information or taking actions that compromise the security of their account or system.
How phishing works
Traditional phishing involves creating emails that imitate legitimate communications from companies, financial institutions or other trusted entities. These emails usually contain a link to a fake website that looks authentic. This website invites the victim to enter personal information, such as passwords or credit card numbers. Once the victim provides it, the cybercriminals capture this information and use it for fraudulent activities.
Types of phishing
There are several variants of phishing, each adapted to different scenarios:
Spear phishing: An attack targeting a specific individual or small group, with personalised emails designed to look even more authentic.
Clone phishing: The attacker creates an exact copy of a legitimate email the victim has already received, but changes the links or attachments to redirect to malicious websites.
Whaling: A type of spear phishing that targets high-profile individuals, such as company executives, in order to obtain critical or high-value information.
Impact of phishing
Phishing attacks can have devastating consequences, including financial loss, identity theft and compromised business accounts. For organisations, phishing can lead to data breaches that damage their reputation and expose them to legal liability and fines.
Smishing: Phishing by SMS
Smishing, or SMS phishing, is a variant of phishing that uses text messages (SMS) to deceive victims. This attack method exploits the trust people place in messages received on their mobile phones and how quickly they respond to them.
How smishing works
In smishing, cybercriminals send text messages that appear to come from a trusted entity, such as a bank, a telecoms operator or an online shop. These messages usually contain a link to a fake website or a phone number that connects the victim directly to the fraudsters. By clicking the link or calling the number, the victim ends up providing sensitive information.
Characteristics of smishing
Urgency: Smishing messages often create a sense of urgency. For example, they claim there is a problem with the victim’s account or that immediate action is needed to avoid negative consequences.
Personalisation: Smishing attacks can be highly personalised, using known information about the victim to make the message more convincing.
Common examples of smishing
Bank fraud: A message claiming to be from the victim’s bank, asking them to confirm a suspicious transaction, with a link to ‘verify’ the account.
Fake promotions: Offers of prizes or discounts that redirect the victim to malicious websites that collect personal data.
Risks of smishing
Smishing poses a significant risk, as people generally see SMS messages as more reliable than emails. In addition, mobile phone users may be less cautious when interacting with these messages, which increases the likelihood of a successful attack.
Vishing: Social engineering by voice
Vishing, or voice phishing, uses phone calls to deceive victims and obtain sensitive information. This type of attack combines social engineering with manipulation techniques that take advantage of the human tendency to trust friendly voices or apparent authorities.
How vishing works
In vishing, the attacker calls the victim and pretends to represent a legitimate organisation. For example, they may pose as a bank, a service company or even a public body. During the call, the attacker persuades the victim to reveal confidential information, such as bank account numbers, passwords or social security numbers.
Common vishing techniques
Caller ID spoofing: Attackers use technology to falsify the phone number that appears on the victim’s caller ID. As a result, the call appears to come from a trustworthy source.
Impersonating authorities: Fraudsters often pretend to be law enforcement officers, such as police, or representatives of financial institutions, to intimidate the victim and pressure them into providing information quickly.
Examples of vishing
Technical support scams: The attacker pretends to be an IT technician and persuades the victim to grant remote access to their computer. With that access, they can steal data or install malware.
Fraud in the name of the tax or social security authorities: The attacker claims to represent a public body. They then threaten the victim with fines or prison if they do not immediately provide identification or payment details.
Impact of vishing
Like phishing and smishing, vishing can lead to significant financial losses and compromise the security of personal information. In addition, vishing attacks can be emotionally draining for victims. Victims often only realise they have been deceived after revealing sensitive information.
Prevention and best practice
Protecting against phishing, smishing and vishing requires a combination of vigilance, education and technology. Below are some best practices that individuals and organisations can adopt to protect themselves against these threats:
Training and awareness
Regular training for employees and users on phishing, smishing and vishing techniques is essential. Training should include examples of common attacks, warning signs to look out for and guidance on how to respond to fraud attempts.
Multi-factor authentication (MFA)
Implementing multi-factor authentication (MFA) to protect accounts and systems can significantly reduce the impact of a phishing or vishing attack. This protection holds even if an attacker obtains the login credentials.
Verifying sources
Before providing any sensitive information, it is important to verify the authenticity of the source. For example, if you receive an email or SMS from a bank, call the bank on a known phone number instead of replying to the message.
Using security tools
Security tools such as advanced spam filters, firewalls and anti-phishing software can help block many attacks before they reach the user.
Reporting incidents
Encouraging people to report phishing, smishing or vishing attempts, both within the organisation and to the competent authorities, helps identify and mitigate threats in real time.
New variants: Quishing and synthetic voices
Attacks keep evolving. For example, quishing uses QR codes on posters, invoices or emails to lead victims to fake pages, bypassing filters that analyse links. In addition, artificial intelligence makes it possible to create highly convincing synthetic voices, used in calls that imitate well-known directors or suppliers. Therefore, no urgent request for payment or credentials should be accepted on the basis of a call or message alone.
Practical example: A supplier’s IBAN change
Suppose the accounts department receives an email, apparently from a regular supplier, asking for the IBAN to be changed for future payments. The email has the correct logo and a credible signature. However, the company has a rule: any change to bank details is confirmed by phone, using the number already on the supplier’s record. During the call, the supplier confirms they did not send the request. The company thus avoids a transfer to the fraudsters’ account and reports the incident.
Protection checklist
- Multi-factor authentication enabled on platforms and email.
- Changes to bank details confirmed through another channel.
- Regular training with real examples.
- Simple internal channel for reporting suspicious messages.
- Up-to-date email filters and browsing protection.
Where to report in Portugal
Cybersecurity incidents can be reported to the National Cybersecurity Centre (CNCS). Where there is loss or a crime, the victim should file a complaint with the authorities. If personal data is involved, the organisation must also assess whether to notify the CNPD, the Portuguese data protection authority.
Frequently asked questions
What should I do if I click a suspicious link?
Do not enter any data, change your password immediately via the official website, enable multi-factor authentication and inform the IT team.
Conclusion on phishing, smishing and vishing
Phishing, smishing and vishing are increasingly sophisticated forms of digital fraud that exploit human vulnerabilities to steal information and compromise data security. As these threats continue to evolve, it is crucial for individuals and organisations to remain vigilant and take a proactive approach to prevention. A combination of education, advanced security technologies and rigorous verification practices is the key to mitigating the risks of these attacks. Ultimately, effective protection against phishing, smishing and vishing depends as much on technology as on user awareness and behaviour.
Read also: Responding efficiently to security incidents and The code that holds digital data hostage.