Phishing, smishing and vishing explained

Phishing, smishing and vishing are the same trick through different channels: phishing usually arrives by email, smishing by text message and vishing by phone call. Scamwatch describes phishing scams as “attempts by scammers to deceive you into giving out your personal information”. Scammers do this by impersonating trusted people or organisations, through emails, text messages, phone calls and fake websites. Phishing is a common way for scams to begin and accounts to be taken over.

This guide explains phishing vs smishing (by text message) vs vishing (by phone call), how each works, the warning signs, and how to check and report a suspicious message using common email and messaging apps.

Three main forms

Phishing usually means a fake email. Scamwatch notes that scammers “use real logos, official-looking branding and threatening language” to make messages look like they come from real companies.

Smishing is phishing by text message (SMS). Texts are short, so they lean heavily on urgency: a parcel that can’t be delivered, a toll that’s overdue, an account that’s been locked.

Vishing is voice phishing: a live call or an automated message. Scamwatch says scammers make calls and send messages “claiming to be from a trusted source like your bank, the government, or the police”, and warns of “automated phone calls and messages claiming your bank account has been compromised” and demanding immediate action.

Phishing also arrives through social media, messaging apps and QR codes. See QR code phishing and impersonation scams.

How phishing works

Almost every phishing attempt has four parts.

1. A believable disguise

The message copies the look of a real organisation. A few tricks do most of the work:

• The display name isn’t the address. Every email has a display name (“Your Bank Security”) and an actual sending address. Many apps show only the name by default. Anyone can type any display name, so it proves nothing on its own. The address behind it is what counts.
• Look-alike addresses. A scam address might be one character off the real one, add a word like “secure” or “support”, or use a different ending. Scamwatch lists a website address that’s slightly different from the usual one, and sender details that don’t match the organisation, as warning signs.
• The real name in the wrong place. An address such as mybank.example.account-check.example contains a familiar name, but the part that matters is the end: this one belongs to account-check.example, not mybank.example.
• Spoofing. Sometimes the “From” line itself is faked. Mail services check for this, and both Gmail and Outlook show a warning when they can’t confirm a message really came from the domain it claims. The steps below show where to look.

2. A reason to act now

Scamwatch lists demands for urgent action as a warning sign. A deadline, a threat to close an account or a prize that expires today all push people to act before they think.

3. A simple action

Click a link, open an attachment, scan a code, call a number or read out a code.

4. The payoff

The ACSC’s small business guide says “Phishing attacks typically compromise your account passwords”, and that phishing scams often contain a link to a fake website where you are encouraged to log in. Scamwatch warns that attachments and apps “can install malicious software on to your computer or phone”. A one-time code read out over the phone can let a scammer sign in as you, which is why Scamwatch says never to share one.

Fictional examples

A smishing text. Priya receives: “Your account has been locked due to unusual activity. Verify now at secure-login.example to avoid suspension.” There’s no name, the address isn’t her provider’s, and the tone is urgent. All three are on Scamwatch’s list.

A phishing email. Leo gets an email from “Accounts Team” with an invoice attached for a laptop he never ordered. The attachment asks him to “enter your email address and password to open it”. Microsoft lists exactly this, an invoice for a purchase you didn’t make with a locked attachment asking for your email and password, as a phishing sign. When Leo checks the sending address, it’s billing@invoices-desk.example.

A vishing call. Ana’s phone rings and an automated voice says her bank account “has been compromised” and to press 1. The person who answers asks her to read out a code that’s just arrived by text “to verify it’s really you”. Scamwatch says never to share one-time codes, even with someone who says they’re from your bank.

These examples are fictional. Names and addresses are invented.

Warning signs

Scamwatch’s phishing page lists signs including:

• a message or call claiming to be from a business you deal with, asking you to update or verify details, or saying there’s a problem with your account
• a demand for urgent action
• a message that doesn’t use your proper name
• sender details that don’t match the organisation it claims to be from
• a website address that’s slightly different from the usual one.

Apple’s guidance adds signs such as a message that “looks significantly different from other messages” from the company, a link whose real address doesn’t match the company’s website, requests for personal information “like a credit card number or account password”, and unsolicited attachments. Google says: “Gmail won’t ever ask you for personal information, like your password, over email.”

A message with perfect spelling can still be fake. Scamwatch explains that AI, also used in deepfake and voice-cloning scams, helps scammers create “thousands of personalised emails, texts, and social media messages”, and that personalisation alone doesn’t show a message is legitimate.

How to check a suspicious message

How to check an email’s real sender address

The steps below are based on each maker’s help pages (checked October 2026). Menus change between versions; the linked guides have the latest steps.

Gmail on a computer (based on Google’s Gmail Help):

1. Open the email and look at the sender. Google says to “Check that the email address and the sender name match”.
2. Look for a question mark next to the sender’s name. Google says this means the message isn’t authenticated, and to “be careful about replying or downloading any attachments”.
3. For more detail, click More next to Reply, then Show original. This opens the full header in a new window.

Gmail on Android (based on Google’s Gmail Help):

1. Open the email.
2. Tap View details, then View security details.
3. Google says a message is authenticated if you see a Mailed by header with a domain name and a Signed by header with the sending domain.

Outlook (based on Microsoft Support):

• Microsoft says Outlook “displays a ‘?’ in the sender photo” when it can’t verify the sender. Not every unverified message is malicious, but a familiar sender who suddenly shows a “?” may be being spoofed.
• Outlook shows a via tag when the actual sending address differs from the From address. Microsoft says to be cautious about interacting with a message with a via tag that you don’t recognise.

Apple Mail and other apps (based on Apple Support):

• Apple’s guidance is to compare the sender’s email address or phone number with the company’s name and with the contact details you originally gave that company.

A genuine-looking address isn’t proof either. Scamwatch’s core check is to contact the organisation using details from its official website or app.

How to check a link before you open it

Apple says that on a Mac you can hover over a link to see its real address, and on an iPhone or iPad you can touch and hold the link. Google says that on a computer “you can hover over any links before you click on them”, and that a link whose address doesn’t match its description may lead to a phishing site. Look at the end of the web address, just before the first single “/”, to see who really owns it.

A safer route than any link is the one Scamwatch describes: log in through the organisation’s own app, or type its address into your browser yourself.

Other checks Scamwatch describes

• Search the exact wording of the message, the phone number, the email address or the organisation’s name together with the word “scam”.
• If an organisation contacts you, contact it directly using details from its official website or app, not the details the caller or sender gives.

For a structured way to think through a message, see is this a scam?.

How to limit the damage

• Multi-factor authentication. The ACSC says multi-factor authentication “defends against the majority of password-related cyberattacks”, because an attacker who gets one layer still needs to break a second barrier. It also says: “Never approve unknown sign-in attempts or share your MFA code.” See how to secure your online accounts and passkeys explained.
• Updates. The ACSC’s small business guide lists “Update your software” among its three starting measures, alongside turning on multi-factor authentication and backing up information.

To practise spotting the signs, the Phishing Awareness Quiz has ten fictional examples with explanations.

If you’ve already responded

Scamwatch’s steps:

1. Act fast: contact your bank or card provider to report it and ask them to stop any transactions.
2. Change passwords on banking, email, government and shopping accounts.
3. Contact IDCARE on 1800 595 160 for a free plan to limit the damage.
4. Report the scam to Scamwatch once your details are secured.

See first steps after a scam, and if an account has been taken over, what to do if an account has been hacked.

How to report phishing

Reporting tells your email provider about the message. Google, for example, says that when you move an email into Spam, “Google receives a copy of the email and any attachments”, which it may analyse to protect users.

Gmail on a computer (based on Google’s instructions, checked October 2026):

1. Open the message.
2. Next to Reply, click More.
3. Click Report phishing.

Outlook on the web and Outlook.com (based on Microsoft’s instructions, checked October 2026):

1. Select the message in the message list.
2. Above the reading pane, select Report, then Report phishing.

Microsoft notes that reporting doesn’t block the sender; blocking is a separate setting (the blocked senders list).

Classic Outlook for Windows (based on Microsoft’s instructions, checked October 2026):

1. Select the message.
2. On the Home tab, select Report.
3. Choose Report Phishing.

Outlook for Android and iPhone (based on Microsoft’s instructions, checked October 2026):

1. Open the email.
2. Tap the ⋮ icon at the top right.
3. Choose Report Junk, then Phishing.

Microsoft’s help pages list the new Outlook for Windows but don’t give separate reporting steps for it, so none are given here.

Messages that pretend to be from Apple. Apple says to forward suspicious emails to reportphishing@apple.com, and for a suspicious text that looks like it’s from Apple, to email a screenshot to the same address.

Messages that pretend to be from Services Australia or myGov. Services Australia says: “If you get an email scam, forward the entire email to reportascam@servicesaustralia.gov.au.” For a text, it describes sending a screenshot showing the suspicious link to the same address. Either way, it then describes deleting the message and blocking the sender.

How to report a scam text

iPhone Messages: Apple says to tap Report Junk under the message.

Google Messages on Android (based on Google’s instructions, checked October 2026):

1. Touch and hold the conversation.
2. Tap Block, then Report spam, then OK.

Google notes you can report spam without blocking the contact, and that reporting moves the message to the Spam and blocked folder.

Where else to report

Scamwatch takes scam reports at scamwatch.gov.au/report-a-scam. See where to report scams and cybercrime in Australia for other options, including ReportCyber.

Common questions

How can I recognise a phishing scam?

Look at what the message asks for and how it pushes. Scamwatch’s warning signs include a message saying there’s a problem with your account, a demand for urgent action, a message that doesn’t use your proper name, sender details that don’t match the organisation, and a web address that’s slightly different from usual. A request for passwords, card details or one-time codes is another sign. See warning signs.

What’s the difference between phishing, smishing and vishing?

They’re the same trick through different channels. Scamwatch describes phishing as attempts to deceive people into giving out personal information. Phishing usually means a fake email, smishing uses text messages (SMS), and vishing uses phone calls, either live or automated. All three try to get passwords, codes, money or personal details. See three main forms.

How do I check if an email is really from who it says?

Check the actual sending address, not just the display name, because anyone can type any display name. Google says to “Check that the email address and the sender name match”, and Gmail and Outlook show a “?” when they can’t verify the sender. Scamwatch’s core check is to contact the organisation using details from its official website or app. See how to check an email’s real sender address.

Can a phishing email use my name and have no spelling mistakes?

Yes. Scamwatch says AI helps scammers create “thousands of personalised emails, texts, and social media messages”, and that personalisation alone doesn’t show a message is legitimate. Scammers also “use real logos, official-looking branding and threatening language”. That’s why official guidance focuses on checking the request through the organisation’s own website or app rather than judging how the message looks. See warning signs.

What do I do if I’ve clicked a link or replied to a phishing message?

Scamwatch’s steps start with contacting your bank or card provider to report it and ask them to stop any transactions. It then lists changing passwords on banking, email, government and shopping accounts, contacting IDCARE on 1800 595 160 for a free plan, and reporting the scam to Scamwatch once your details are secured. See if you’ve already responded.

How do I report a scam text or phishing email in Australia?

Scamwatch takes scam reports at scamwatch.gov.au/report-a-scam. In apps, Gmail has Report phishing, Outlook has Report > Report phishing, iPhone Messages has Report Junk, and Google Messages has Report spam. Services Australia says to forward myGov or Services Australia scam emails to reportascam@servicesaustralia.gov.au. See how to report phishing.