The Common Thread

Phishing, smishing, vishing, and quishing are four variants of the same fundamental attack. They differ in the channel used to reach the victim — email, SMS, phone, or QR code — but the underlying mechanism is identical: impersonation and manipulation.

Attackers study the brands, institutions, and communication styles that people trust most. They then craft convincing replicas — emails that look like they came from your bank, text messages that match your parcel carrier's format, phone calls that spoof your government's caller ID — and use them to manipulate victims into doing one or more of the following:

Understanding each variant makes you dramatically harder to fool — because recognition is the first line of defence.

Phishing (Email)

Email phishing is the oldest and most prevalent form. Attackers send fraudulent messages that appear to come from well-known organisations: banks like Standard Bank or Nedbank, tech giants like Microsoft and Google, retailers like Amazon, or payment services like PayPal. The emails are often visually polished, using stolen logos and copied formatting from legitimate communications.

The core tactic is urgency. "Your account has been compromised — verify immediately." "Your payment failed — update your details within 24 hours." The time pressure bypasses rational scepticism and pushes victims to act before they think.

Common red flags to watch for:

Smishing (SMS)

Smishing applies the same phishing principles to SMS text messages. The format is almost always the same: a short message with a brief claim and a link. "Your FNB account has been suspended — verify here." "Your SAPO parcel could not be delivered — click to reschedule." "SARS: you are entitled to a tax refund."

SMS feels more intimate and immediate than email. Notifications arrive on the same device you use for banking apps, creating a false sense of contextual legitimacy. Additionally, short URLs in SMS messages make it nearly impossible to preview the destination before tapping.

The rule is simple: never click links in unexpected SMS messages. If you receive a message claiming to be from your bank, navigate to the bank's official website yourself by typing the URL directly into your browser. The same applies to parcel tracking — go to the courier's website and enter your tracking number manually.

Vishing (Voice)

Vishing — voice phishing — moves the attack to a phone call. Attackers impersonate bank fraud departments, tax authorities (SARS, HMRC, IRS), police, Microsoft support, or telecommunications companies. Modern voice-over-IP technology makes it trivial to spoof any caller ID, so the number displayed on your screen may appear to be your bank's genuine number.

A skilled visher builds rapport quickly, references details obtained from prior data breaches (your name, part of your account number, your address), and creates artificial urgency: "Fraudulent transactions are being processed on your account right now — we need to verify your identity immediately."

They may then ask you to:

Legitimate organisations will never ask for your password, PIN, or full OTP over the phone. If you receive a suspicious call, hang up and call the organisation back using the number printed on their official website or the back of your card.

Quishing (QR Code)

Quishing is the newest and fastest-growing variant. Attackers embed malicious URLs inside QR codes — which, unlike text links, cannot be visually inspected before scanning. The QR code is distributed via email (to bypass URL-scanning security tools), physical posters in public spaces, fake parking fine notices placed on car windshields, or even replacement stickers placed over legitimate QR codes in restaurants and shops.

When scanned, the code redirects the victim to a convincing lookalike login page that harvests their credentials, or to a site that exploits browser vulnerabilities to deliver malware. The attack is particularly effective on mobile devices, where the full URL is rarely displayed prominently.

Before scanning any QR code from an unexpected source, preview the URL it resolves to. Most phone cameras show the destination URL before opening it — check it carefully. If the domain looks suspicious, do not proceed.

How to Protect Yourself

Across all four attack types, the same principles apply:

BreachWatcher alerts you if your credentials appear in a phishing campaign database. If you receive a suspicious communication — an email demanding you verify your account, an SMS with an unexpected link, a caller asking for your OTP — do not engage. Verify through official channels first. Your BreachWatcher alert is a safety net, not a replacement for caution.