All four attacks chase the same result through different channels. Phishing uses email, smishing uses text messages, vishing uses voice calls and quishing uses QR codes. Each channel removes a familiar safety signal. The best universal defence is to verify unexpected requests through a separate route you already trust, never through contact details supplied by the request itself.
Click to load the YouTube player. Watch on YouTube ↗
- 01Phishing is both the umbrella term and the common name for the email version.
- 02Smishing reaches a phone that may sit outside workplace security monitoring.
- 03Vishing replaces visual clues with a persuasive, increasingly cloneable voice.
- 04Quishing hides a destination inside an image or physical sticker.
- 05Urgency and a request for money, credentials or access unite all four.
Why “phishing” means two things
Phishing is the umbrella term for deceptive messages that manipulate somebody into handing over money, credentials or access. It is also the original term used for the email version. Smishing, vishing and quishing describe channel-specific variations that inherited the same naming pattern.
In everyday conversation, “phishing” usually means email. In a security programme, it can describe the entire family. The important question is not which label sounds newest; it is which delivery channel reached the target and which protections were absent.
The four channels, side by side
- BLIND SPOT
- Text and link filters
- OLD CLUE THAT WEAKENED
- Bad grammar
- 2026-STYLE EXAMPLE
- A flawless CFO request from a lookalike domain
- BLIND SPOT
- Corporate tools never see the personal phone
- OLD CLUE THAT WEAKENED
- Unknown number
- 2026-STYLE EXAMPLE
- A package or toll notice with an urgent payment link
- BLIND SPOT
- There is no link or header to inspect
- OLD CLUE THAT WEAKENED
- Unnatural voice
- 2026-STYLE EXAMPLE
- A cloned employee voice requesting an MFA reset
- BLIND SPOT
- The destination is hidden inside an image
- OLD CLUE THAT WEAKENED
- Obvious sticker tampering
- 2026-STYLE EXAMPLE
- A PDF QR code opening a fake work login
Phishing: the original high-volume channel
Email phishing remains the most familiar form, but the visible quality has changed. Generative tools can create fluent, context-aware messages without the spelling errors that once made many scams obvious. A message can reference a real project, use an executive's normal tone and still route the recipient to a lookalike domain.
A finance employee receives a polished request appearing to come from the CFO. It names a real internal project and demands a transfer before a deadline. The decisive clue is not the writing; it is a sender domain with one substituted character.
Smishing: a text outside the corporate perimeter
Smishing arrives through SMS or a messaging app. A personal phone may not have the link sandboxing, domain reputation controls or attachment inspection used by a managed work inbox. That makes delivery and toll-payment messages effective because they combine a familiar phone interaction with a small, urgent charge.
A package notice says an address is incomplete and asks for a small redelivery fee. The link opens a convincing postal-service clone designed to collect card details and personal information.
Vishing: a persuasive voice with no header to inspect
Vishing happens through a phone call. The listener cannot hover over a link or examine an email domain. Attackers may combine public information, a cloned voice and mild operational pressure to impersonate an employee, manager, bank or supplier.
A caller sounds like a real employee, names their manager and tells the help desk they are locked out before a client meeting. The goal is a password or MFA reset that provides legitimate access.
Quishing: the destination hidden inside an image
Quishing places a malicious destination inside a QR code. The code may appear in an email attachment, on a poster or as a sticker placed over a legitimate parking or restaurant code. Scanning moves the decision to a phone, where the destination can be harder to inspect and workplace protections may be absent.
An “MFA update” PDF asks an employee to scan a new setup code. The code opens a fake workplace login page on the employee's phone and captures the credentials entered there.
The pattern underneath all four
Attackers route the request through the channel where attention and controls are weakest. Better email filtering pushes some activity toward personal texts. Link-awareness training encourages voice calls that contain no link. Improved text scanning encourages QR images that conceal the destination.
No channel is permanently solved. The transferable skill is recognising the request beneath the format: who wants action, what they want, why it must happen now and how you can verify it without using their route.
What holds up across email, text, voice and QR codes
- Verify separately.Call a known number, open the official app or contact the colleague through an established internal channel.
- Slow down urgency.Deadlines, suspension warnings and executive pressure are reasons to check more carefully, not move faster.
- Keep the same proof standard.A familiar voice, professional QR code or perfect grammar deserves the same scrutiny as a suspicious link.
- Use phishing-resistant authentication.A passkey or hardware key cannot be typed into a fake page in the way a password or one-time code can.
- Report the attempt.Reporting helps carriers, email administrators and security teams protect the next target even when you did not fall for it.
In the UK, suspicious texts can be forwarded to 7726. Employees should use their organisation's reporting channel for suspicious emails and calls.
See the manipulation in action
Practise identifying the signal beneath the delivery format through three different DirtyPhish scenarios.
PRIMARY PRACTICE
ROMANCE SCAMS
NETWORK DEFENCEQuestions people ask
Is quishing simply phishing with extra steps?+
The goal is normally the same, but a QR code changes the delivery mechanism. Image-based codes can bypass checks that are designed to inspect visible text links.
Why has vishing become more convincing?+
Voice cloning, personal information gathered online and repeatable help-desk impersonation scripts can make a fraudulent call sound informed, urgent and familiar.
Can spam filters catch smishing?+
Mobile carriers filter some SMS spam, but texts generally bypass the attachment scanning, link sandboxing and domain controls used by corporate email systems.
If grammar is no longer reliable, what should I inspect?+
Check the real sender domain, destination, request and context. Verify unexpected action through a separate contact method you already trust, and treat urgency as a warning rather than an instruction.
Which phishing channel is most dangerous for a business?+
Impact depends on context. Vishing can produce high-impact help-desk and payment fraud, while email remains a vast attack surface and smishing or quishing can bypass controls that never see the interaction.