Smishing, vishing and quishing explained

Phishing started with email, but it moved to wherever people pay attention. Today a lot of it arrives as a text, a WhatsApp message, a phone call or a QR code. Each has a name, and each has a simple rule. This guide explains all three, and the one pattern behind them.

Smishing: phishing by SMS and chat

Smishing means phishing through text messages and messaging apps.

Common examples include a “bank” message saying your account will be blocked, a delivery notice with a link, an electricity bill warning that your power will be cut tonight, or a “KYC update” with a button to tap. They work because texts feel personal and are read quickly, often on a small screen that hides the full address.

The rule: do not tap a link in an unexpected message. Open the official app, or type the website address yourself. Two worked examples: the fake KYC message and the parcel fee SMS.

Vishing: phishing by phone call

Vishing is a scam call. The caller says they are from your bank, the police, customs, a telecom company or tech support. They sound confident, they know a few details about you, and the number on your screen can be made to look genuine.

They want you to share an OTP, install a screen-sharing app, or move money “to a safe account”.

The rule: a real organisation will not ask for your OTP or PIN, and will not make you act in a hurry. Hang up, then call the number printed on your card or on the official website. For the most serious version of this scam, read the “digital arrest” call, explained.

Quishing: phishing by QR code

Quishing hides a link inside a QR code. You cannot read a QR code with your eyes, so you cannot spot a fake address. Scammers put codes on stickers, posters, parking notices and even letters.

A particularly common trick is a code that is supposed to send you money. Scanning a code to receive money is a trap: you never need to scan anything, or enter a UPI PIN, to receive a payment. More on that here.

The rule: check where a code leads before you open it, and be wary of codes that appear unexpectedly or that cover another code.

The pattern behind all three

Whatever the channel, the steps are the same:

1. A message that looks like it comes from someone you trust.
2. A reason to hurry.
3. A link, a call, or a scan that moves you away from the official place.

Spot those three things and you can spot almost any of these scams.

Quick reference

Name	Channel	What they want	Your rule
Smishing	SMS and chat apps	A tap on a link, a payment or a login	Do not tap links in unexpected messages
Vishing	Phone calls	An OTP, a PIN or a money transfer	Hang up and call the official number
Quishing	QR codes	A scan that opens a fake page or a payment	Check where a code leads, never scan to receive money

What to do if you have been caught

Do not blame yourself. These messages are built to work on busy people. Stop, then work out what you shared or paid. This ten-minute checklist covers each case, and here is how to report it. You can also report suspicious numbers and messages on the Sanchar Saathi portal.

One tool for all three

For a link, whichever channel it arrived through, you can paste it into the RIEG link checker without opening it. For a call or a code, the safest tool is a pause. If you want the full background, start with what phishing is and how it works.