← Human Risk Under Pressure: Decisions That Protect You and Your Team
The Psychology of Trust and Pressure
How Attackers Exploit Your Brain's Shortcuts The Urgency Trap — When Speed Overrides Judgment Authority, Familiarity, and the Power of Context
Real-World Attack Scenarios
Email and Messaging Attacks — Spot the Fake Voice and SMS Attacks — The Human Side of Social Engineering Multi-Stage Attacks — When Trust Is Built Over Time
Decisions and Actions That Protect
Pause, Verify, Decide — Your Personal Process What to Do When You're Not Sure Reporting Without Fear — How Early Reporting Changes Outcomes
Real-World Attack Scenarios

Voice and SMS Attacks — The Human Side of Social Engineering

Learn how attackers use voice calls and SMS messages to build trust and extract information quickly.

In this lesson, you will learn to:

  • Recognize common vishing and smishing tactics, and describe at least two verification techniques you can use when you receive unexpected calls or SMS.

Voice and SMS Attacks — The Human Side of Social Engineering

This lesson covers vishing (voice phishing) and smishing (SMS phishing). You’ll learn how attackers impersonate trusted entities over the phone and through text, and practice techniques to verify identity in real time.

The Human Voice and the Trust It Creates

A phone call feels personal. When someone speaks to you with a confident, professional tone, it’s natural to trust them. Attackers know this, and they use voice calls — vishing — to bypass the skepticism you might apply to an email. They can spoof phone numbers to look like they’re calling from your bank, your IT department, or even a colleague.

SMS attacks, or smishing, work similarly. A text message feels more intimate than email, and urgency works even better on mobile because people are often distracted when reading texts.

How to protect yourself:

  • If you get an unexpected call asking for sensitive information, hang up and call back using a number you know is legitimate (like the one on your bank card or official website).
  • For SMS messages, treat them like email — don’t click links from unknown numbers, and verify through a separate channel.
  • Remember: legitimate organizations will never ask for passwords, PINs, or full account numbers over the phone or via text.
Vishing vs SmishingTwo columns comparing voice (vishing) and SMS (smishing) attacks with key traits and what to do for each.Vishing vs SmishingVishing (Voice)Spoofed caller IDPressure to actAsks for sensitive infoImpersonates authorityHang up and call backSmishing (SMS)Unexpected textLinks to fake sitesUrgent action requiredSeems from trusted sourceDon't click. Verify.Both rely on trust and pressure. Verify through a known channel.
Vishing vs Smishing — A comparison of vishing and smishing attacks with key characteristics and defensive actions.
Verify Before You TrustA decision diagram: Unexpected Contact, Pause and don't act, Verify using known channel, If valid proceed or if suspicious report.When You Get an Unexpected Call or TextUnexpected ContactPause and don't actVerify through a known channelCall the official number, not the one in the messageIf valid: proceed. If suspicious: report.Don't engage with the suspicious messageTrust is earned, not assumed. Verify first.
Verify Before You Trust — A decision diagram for handling unexpected calls and texts: pause, verify through a known channel, then decide.
← Previous: Email and Messaging Attacks — Spot the Fake Next: Multi-Stage Attacks — When Trust Is Built Over Time →