1. What smishing and vishing are
Smishing is a variant of phishing that arrives by text message instead of email. It works the same way: you get a text message that appears to come from a delivery company, your bank or an official body, with a link that takes you to a fake website where you're asked to enter personal information, passwords or your card number. The goal is always the same, to get information or money out of you by taking advantage of the fact that a text feels more direct and trustworthy than an email.
Vishing is the same thing but by voice: a phone call where someone poses as an employee of your bank, technical support, or even a relative in trouble, to ask you to hand over information, make a transfer, or give them a code that just arrived by text. It's becoming more common for these calls to use automated or recorded voices to sound more believable, and some even mimic the voice of someone you know using artificial intelligence tools.
2. Warning signs you should recognize
Both smishing and vishing share several traits that, if you learn to spot them, will put you on alert right away:
- Excessive urgency: "you have 24 hours to act", "your account will be blocked today" or "the package will be returned if you don't confirm now". They want you to react without thinking.
- Spelling mistakes or wording that doesn't fit: missing accents, odd phrasing, or a tone that doesn't match what that company usually uses with you.
- Links with strange domains: addresses that look like the official ones but with swapped letters, added words, or endings that aren't the usual ones for that company.
- They ask for information no real entity requests that way: your full password, your card's security code, or the verification code that just arrived by text. Neither your bank nor any official body will ever ask for these by text or phone.
- Emotional pressure on calls: voices that sound nervous or that insist you not hang up, not talk to anyone else, or act right at that moment.
3. What to do if you receive a suspicious text or call
If you get a message or call that makes you doubt, follow these steps before doing anything else:
- Don't tap the link in the text, even if it seems urgent. If you want to check something (a package, a charge, a notice), go directly to the official website or app by typing the address yourself or opening the icon you already have installed.
- Don't give out any information over the phone even if the caller claims to be from your bank or technical support. If you're unsure, hang up and call the official number you already had saved yourself.
- Never share a verification code that arrives by text, even if asked by someone claiming to work for the company that sent it. That code is only for you.
- Block the number from your phone's call or message settings so it can't contact you again.
- If you've already given some information, contact your bank immediately to explain what happened, so they can block the card or monitor your account if needed. The sooner you report it, the lower the risk.
4. How to report it
Reporting these attempts helps stop them before they reach more people. If you've received a suspicious text message, in Spain you can forward it for free to 7726, a number set up so carriers can identify and block these scam campaigns. If it was a call, write down the number and the reason in case you need to provide it later.
If you've also suffered financial harm or data theft, it's recommended to file a report with the National Police or the Civil Guard, who have units specializing in cybercrime, and also notify the National Cybersecurity Institute (INCIBE) through their help line.