Vishing, Smishing, and Pretexting

While phishing dominates headlines, attackers use multiple communication channels to manipulate victims. Vishing uses voice calls, smishing uses SMS text messages, and pretexting is the practice of constructing a believable false scenario (pretext) to justify why the victim should comply with a request. These attacks succeed not because victims are ignorant, but because they exploit fundamental human instincts: trust in authority, desire to be helpful, and the tendency to follow instructions when under pressure.

Vishing (voice phishing) uses phone calls to manipulate victims. Common pretexts include impersonating an IRS agent threatening arrest for unpaid taxes, a bank fraud department warning of suspicious transactions, tech support claiming to have detected a virus, or a government benefits office requiring verification. Attackers use caller ID spoofing to display the phone number of a legitimate organization. Robocall vishing campaigns operate at scale, then connect interested victims to live operators. The real-time nature of voice calls creates pressure that makes critical thinking difficult.

Smishing (SMS phishing) delivers phishing lures via text message. Common smishing messages impersonate package delivery services (FedEx, UPS, USPS) with fake tracking notifications containing malicious links, banks warning of suspicious charges, or mobile carrier notifications about account problems. Smishing URLs often use URL shorteners or look-alike domains. Mobile users are arguably more vulnerable than desktop users because smaller screens make URL inspection harder, and mobile browsers often hide the full address. SMS also carries inherent trust — users tend to act more quickly on text messages than emails.

Pretexting is the fabrication of a false but believable scenario that creates context for a social engineering request. Without a convincing pretext, requests for sensitive information or unusual actions would immediately raise suspicion. A pretexting attacker might impersonate a new IT contractor who needs help accessing systems, an auditor requiring access to financial records, or a vendor delivery person who needs to be 'buzzed in.' The pretext does not have to be elaborate — it just needs to be plausible enough that the target does not stop to verify before complying.

Robert Cialdini's principles of influence explain why social engineering works. Authority — people comply with those perceived as authority figures (CEO, IRS, police). Urgency/Scarcity — time pressure prevents careful evaluation ('Act in the next 10 minutes'). Social proof — people do what others are doing. Liking — people comply with those they trust or find agreeable. Reciprocity — people feel obligated to return favors. Commitment — once a small commitment is made, people tend to follow through on larger ones. Understanding these principles helps security awareness trainers craft more effective counter-messaging.

Modern VoIP technology makes caller ID spoofing trivial. Services like SpoofCard, Twilio, and various VoIP APIs allow anyone to set the displayed caller ID to any number before placing a call. Attackers routinely spoof bank customer service lines, government agency numbers, or the victim's own number (neighbor spoofing). The STIR/SHAKEN framework (Secure Telephony Identity Revisited / Signature-based Handling of Asserted information using toKENs) was mandated in the US to cryptographically authenticate caller ID, but adoption is incomplete. Never trust caller ID alone to verify identity.

Help desk staff are prime targets for vishing because their job is to help users — creating a natural tension with security procedures. A typical attack: the attacker calls posing as a senior employee who urgently needs their account reset because they are locked out before an important meeting. The pressure of authority + urgency can cause a well-intentioned help desk agent to skip verification steps. The celebrated 2020 Twitter hack began with vishing attacks on Twitter employees that gained access to internal tools. Help desks need strict identity verification procedures that cannot be waived regardless of urgency.

A SIM swap attack combines vishing and social engineering against a mobile carrier's customer support. The attacker calls the carrier pretending to be the victim, provides answers to identity verification questions (sourced from data breaches or social media), and convinces the agent to transfer the victim's phone number to a SIM card controlled by the attacker. Once the number is hijacked, all SMS-based MFA codes go to the attacker, enabling account takeover of email, banking, and cryptocurrency accounts. SIM swapping has been used to steal millions in cryptocurrency.

Detecting social engineering attacks requires combining employee reporting with technical logging. Every employee should know how to report a suspicious call or text — ideally a one-click button in email or a dedicated email alias (phishing@company.com). Technical indicators include call logs showing inbound calls from spoofed numbers, SIEM alerts on help desk password resets preceded by incoming calls, and out-of-hours account access changes. After an incident, phone records and SMS logs are key forensic artifacts alongside email logs and authentication events.

Defending against pretexting requires establishing verification procedures that employees follow consistently regardless of the pressure they feel. Key policies include: always verify identity through a separate, established channel before fulfilling unusual requests; establish a code word system for executive communications; train employees that authority figures within the organization will not be offended by requests for verification; and create a security-positive culture where following procedures is rewarded even when it causes minor inconvenience. Unannounced social engineering tests measure whether training is effective in practice.

For the Security+ exam, clearly distinguish between the phishing channels. Phishing is via email. Vishing is via voice/phone. Smishing is via SMS text. Pharming redirects DNS without requiring a click. All share the same goal — manipulating the victim into revealing credentials, transferring money, or installing malware — but the delivery mechanism and countermeasures differ. Email has technical defenses (SPF/DKIM/DMARC/sandboxing); voice and SMS have far fewer technical controls, making user awareness training even more critical for those channels.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: vishing uses phone calls with caller ID spoofing to impersonate authority figures and extract credentials or actions, smishing delivers phishing lures via SMS where mobile users have reduced URL visibility, and pretexting creates believable false scenarios that justify unusual requests — defended with strict identity verification procedures, out-of-band confirmation, and employee training. Next up we explore physical social engineering through tailgating and baiting.