Smishing and vishing are social engineering attacks that trick people into revealing secrets or taking unsafe actions through text messages and voice calls. In identity security, they often target credentials, MFA codes, payment details, or help desk workflows, and can be used to bypass human IAM controls and gain unauthorized access.
What Smishing and Vishing Are
smishing and vishing are message-based social engineering attacks that exploit trust in text messages and voice calls. Their power comes from urgency, impersonation, and a believable pretext that pushes the target to reveal secrets or take unsafe actions.
These attacks are dangerous because they do not need technical exploitation first. They can bypass otherwise strong controls by convincing a person to hand over credentials, MFA codes, payment details, or approval for an action that should have been challenged.
How Smishing and Vishing Work
Smishing uses SMS, messaging apps, or fake delivery and account alerts to prompt a fast response. Vishing uses live calls, voicemail, or callback traps to create pressure, answer objections, and steer the target through a scripted interaction.
Both rely on manipulation of the interaction itself. Attackers may spoof sender IDs or caller IDs, mimic help desk language, impersonate executives or vendors, or follow up across channels so the target sees the contact as legitimate.
Why They Are Effective Against Identity Controls
Smishing and vishing are especially effective when security depends on human judgment at the moment of verification. A target may be persuaded to disclose a password, approve an MFA prompt, share an OTP, reset access, or approve a malicious app or payment.
This makes the attacks a direct threat to identity workflows, help desk procedures, and recovery paths. Even when authentication is technically sound, the process around it can fail if a person is tricked into authenticating the attacker or granting access on their behalf.
They also work well as an initial access method because they are low-cost, scalable, and easy to adapt to the organisation’s tools, vendors, and terminology. A successful call or text can open the door to account takeover, data theft, fraud, or lateral movement.
Common Signs and Defensive Signals
Warning signs often include urgency, secrecy, payment pressure, unexpected verification requests, callback instructions, and a mismatch between the channel and the request. A message that asks for an OTP, password, or remote access approval should be treated as suspect by default.
On the defensive side, organisations should watch for repeated short-lived contact attempts, help desk abuse patterns, anomalous authentication resets, and user reports that reference a believable but unverified caller or text. These signals matter because the attack often succeeds before technical controls see a conventional intrusion.
Vishing and Smishing Guide covers help desk impersonation, callback phishing, sender ID spoofing, and practical verification patterns in more detail.
Real-world breaches show the impact clearly: MGM Resorts breach 2023, Twilio 0ktapus breach 2022, and ShinyHunters Salesforce data theft campaign 2025 all show how voice or text pretexts can turn into serious access and data loss.
Risk and Threat Considerations
Smishing and vishing are risky because they weaponise trust at the exact point where people are expected to verify identity, approve access, or approve money movement. The attacker does not need to defeat the control directly if the victim can be induced to do it for them.
Failure mechanism: The attack succeeds when urgency, authority, or fear overrides normal verification, allowing the victim to disclose secrets, approve access, or bypass a required second check.
Impact: The result can be account takeover, fraudulent payment, access to help desk workflows, exposure of sensitive data, or a wider intrusion that begins with a single convincing interaction.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5, NIST SP 800-63 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Smishing and vishing aim to defeat user authentication and account verification. |
| IA-5 — Authenticator Management | These attacks often target passwords, OTPs, and other authenticators. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Help desk abuse and suspicious verification events require reviewable logs. | |
| Recommendation — Enforce strong user authentication and step-up verification for sensitive access and resets. Protect authenticator lifecycle and limit exposure of one-time and reusable secrets. Review authentication and account-change logs for social-engineering-driven abuse. | ||
| NIST SP 800-63 | Authentication Assurance Levels — Digital Identity Assurance and Phishing-Resistant Authentication | The term directly implicates phishing-resistant authentication and verifier trust. |
| Recommendation — Prefer phishing-resistant authenticators for sensitive identity and recovery workflows. | ||
| OWASP ASVS | V6 — Authentication | Smishing and vishing are designed to bypass authentication through user manipulation. |
| Recommendation — Verify that authentication flows resist social-engineering-assisted credential theft. | ||
| MITRE ATT&CK | T1566.004 — Phishing: Spearphishing Voice | Vishing is a direct adversary technique for initial access and pretexting. |
| T1566.001 — Phishing: Spearphishing Attachment | Smishing often delivers lures that initiate credential theft or malware delivery. | |
| Recommendation — Map voice-phishing activity to T1566.004 and detect related pretexting attempts. Correlate text-based lures with phishing and follow-on access activity. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | When vishing or smishing steals codes or credentials, authentication failure is the core risk. |
| Recommendation — Strengthen authentication design so stolen credentials or codes are insufficient on their own. | ||
Practitioner Guidance
Why practitioners should care: This is not just a user-awareness issue, because these attacks often target the organisation’s exception paths, such as resets, approvals, and escalations. Those paths are where a small process gap can produce disproportionate loss.
What to watch for: Treat any channel that asks for secrets, one-time codes, payment confirmation, or urgent access action as a verification event, not a routine message. The most reliable defence is to force the interaction back to a known, independently verified channel before anything is approved.
Deepfakes, Social Engineering and AI Impersonation Guide is also relevant when the voice or message may be synthetic or executive-style impersonation is part of the pretext.
Top 10 Identity Attacks helps place smishing and vishing in the broader family of identity abuse patterns, including MFA fatigue, token theft, and help desk social engineering.
Related resources from NHI Mgmt Group
- How should security teams train users for phishing, vishing, and smishing together?
- How should security teams verify unexpected requests to reduce phishing, vishing, and smishing risk?
- How should security teams reduce phishing, vishing, and smishing risk without relying only on passwords or one-time codes?
- How should security teams implement social engineering risk assessments across phishing, vishing, and smishing channels?