Smishing and Vishing: Scams by Text Message and Phone Call

Scams no longer arrive only by email. Smishing uses text messages and chat apps; vishing (from voice phishing) uses phone calls. The two are often combined: first a text that creates alarm, then a call from a fake operator who "fixes" the problem. These attacks work because the phone feels like a more personal and trustworthy channel than email.

The most common texts

• The courier: "Your parcel is being held, pay 1.99 for redelivery". The link leads to a page asking for card details.
• The bank: "We blocked a suspicious sign-in, verify here". The page imitates the customer area and collects credentials and codes.
• The relative: "Hi Mum, I've lost my phone, this is my new number, message me here". After a few messages comes the request for an urgent transfer.
• Fines, refunds, bonuses: notices of payments due or refunds to claim through a link.

An important detail: some fake texts appear in the same conversation as genuine messages from your bank or courier. This happens because the SMS sender name can be forged, and the phone groups messages by that name. A message being "in the right thread" doesn't prove it's genuine.

How vishing works

The typical call follows a precise pattern:

1. Credibility: the caller introduces themselves as the bank's fraud department, technical support or the police. The number on the display may look like the official one, because caller ID can be forged too (spoofing).
2. Alarm: "We're seeing an unauthorised transfer from your account", "your computer is sending out viruses".
3. Guided solution: "To block it, read me the code you're about to receive", "approve the notification in the app", "move your funds to a safe account", "install this program so we can help you".

Each step raises the tension and reduces the time to think. Sometimes the fraudster already knows your name, your bank and the last digits of your card, perhaps because you entered them shortly before on a smishing page.

The rule that solves almost everything

No legitimate operator will ever ask you on the phone for verification codes, PINs, passwords, or to move money to a "safe account". No bank has a safe account for parking your money. No support service calls you out of the blue to say your computer has a virus.

The codes you receive by text and the notifications you're asked to approve exist precisely to authorise an operation: whoever asks you for them wants to carry out that operation in your place.

What to do when you get a suspicious message or call

For texts

1. Don't tap the link, not even "just to see".
2. If you think it could genuinely concern you, open the official app or type the website address yourself and check from there.
3. Report the message as spam from your phone and delete it.

For calls

1. Hang up, without embarrassment.
2. Call the official number yourself, taken from the back of your card, your contract or the website.
3. If possible, use another phone or wait a few minutes before calling: in some scams the line is kept open to make the victim believe they've really called back.

For the fake relative

Call the relative's old number or another family member, or ask a question only the real person could answer. Some families agree on a code word for emergencies: it's a simple and effective idea.

If you've already given data or codes

Time is decisive:

• contact your bank immediately on the official number and ask for cards and access to be blocked;
• change the password for online banking and email if you entered them on a fake page;
• check the authorised devices in your banking app and remove any you don't recognise;
• if you installed a remote assistance program at the fraudster's request, uninstall it and have the computer checked;
• report it to the authorities, keeping the texts, numbers and times of the calls.

Preventive habits

• Make your bank's app the only channel you use to check your account, never starting from links.
• Turn on notifications for every transaction: you'll notice unusual activity immediately.
• Explain these scams to older relatives and to teenagers: they are often favourite targets.

In short

• Smishing uses texts and chats, vishing uses calls; they often work together.
• Sender names and caller numbers can be forged.
• Nobody legitimate asks you for codes, PINs or to move money to a safe account.
• Hang up, then call the official number yourself.
• If you've handed over data, contact your bank at once and change your passwords.