Phishing is the practice of sending a fraudulent message that impersonates a trusted brand or person in order to steal credentials, payment details, or personal data. This post defines the term across SMS, email, and voice, and separates it from adjacent fraud categories like SMS pumping and caller-ID spoofing.
The definition
A phishing message has two components: a false identity claim (the sender pretends to be a bank, a delivery service, a platform administrator, or a colleague) and a payload (a link, an attachment, or a request that extracts something valuable from the recipient). The channel varies. The social-engineering pattern does not.
How phishing arrives by channel
Email remains the highest-volume phishing channel. Attackers register look-alike domains, spoof display names, or compromise legitimate sending accounts. SPF, DKIM, and DMARC records determine whether a receiving server can verify the sender's domain, which is why domain authentication is the baseline email defense. Orbit covers deliverability and sender identity setup in Email deliverability and Transactional email deliverability and sending identities.
SMS phishing, usually called smishing, uses short links and urgency framing: a failed delivery, a locked account, a toll charge. Because SMS has no link preview by default, recipients often tap before they can evaluate the destination. Orbit's SMS pumping and gray-route fraud explainer covers the messaging-abuse side of the SMS ecosystem.
Voice phishing, or vishing, uses a live caller or a spoofed number to extract information verbally. Attestation frameworks such as STIR/SHAKEN give receiving carriers a signal about whether the calling number was legitimately originated; see STIR/SHAKEN attestation for outbound voice.
A per-channel indicator table
The constant across channels is the two-component pattern — false identity plus extraction payload. What changes per channel is where the false identity lives, what the payload looks like, and which verification signal exists for a recipient or a business. The table collects those per channel:
| Channel | Identity claim lives in | Typical payload | Primary verification signal |
|---|---|---|---|
| SMS | Sender ID, short-code or alphanumeric label | Short link to a credential-harvest page | Destination URL checked independently; sender-brand registration (10DLC, alpha sender-ID rules) |
| Display name and from-domain | Link or attachment harvesting credentials or payment data | SPF, DKIM, DMARC alignment on the sending domain | |
| Voice | Calling number (spoofed) and the verbal script | Verbal extraction of a code, card, or credentials | STIR/SHAKEN attestation level presented to the terminating carrier |
| Impersonated business profile | Link or a moved-to-SMS continuation | Verified business profile and template approval state |
The brand-side lesson from the table: a phishing campaign succeeds by borrowing an identity the recipients already trust, so the defenses that matter are the ones that let customers tell the legitimate sender from the impersonator. For messaging channels, Orbit's brand-impersonation takedown guide walks the operator loop — registering your brand names, domains, and sender IDs on a watchlist, scanning observed candidates, and opening a takedown case with a filing-ready evidence pack. For voice, attestation and biometrics are the same defense one layer down the stack, covered in the resources library: Voice biometrics and anti-spoofing on a CPaaS.
Phishing versus adjacent fraud categories
Teams classifying fraud traffic should separate phishing from two categories that look similar in a message log. SMS pumping inflates traffic to artificially generated numbers for revenue-share or OTP-abuse profit; the victim is the sending platform, not the end recipient. Orbit's SMS pumping fraud explainer and the Verify API OTP fraud monitoring post cover that pattern. Caller-ID spoofing is a delivery technique that phishing campaigns often use, but spoofing alone does not make a message phishing; the defining property is the fraudulent impersonation and extraction attempt.
What to check before you click or reply
- Verify the sender domain or number through an independent channel, not the contact details inside the message.
- Treat urgency and secrecy as signals, not instructions.
- For businesses: authenticate your own sending domains (SPF, DKIM, DMARC) so attackers cannot convincingly impersonate you to your customers, and register your brand tokens on an impersonation watchlist so hostile candidates surface before your customers report them.
- Report suspected phishing to your security team or national reporting portal rather than deleting it.
Where this fits in Orbit's fraud coverage
This definition page fills a gap in Orbit's glossary, where phishing previously appeared only inside the DMARC term. It sits alongside the existing explainers on SMS pumping and gray-route fraud and voice attestation so readers and AI answer engines can resolve the term to a single canonical page.
Frequently asked questions
What is phishing?
Phishing is the practice of sending a fraudulent message that impersonates a trusted brand or person in order to steal credentials, payment details, or personal data. Every phishing message has two components: a false identity claim — the sender pretends to be a bank, a delivery service, a platform administrator, or a colleague — and a payload, which is a link, an attachment, or a request that extracts something valuable from the recipient. The channel varies; the social-engineering pattern does not.
What is the difference between smishing and SMS pumping?
Smishing is phishing delivered over SMS: the recipient is the victim, and the message impersonates a trusted sender to extract something from them. SMS pumping is a different fraud category: an attacker drives fake traffic to revenue-share or premium-rate numbers, and the victim is the sending platform that pays for every accepted leg, not the recipient. The two often appear together in abuse reports, but they have different victims, different signals, and different defenses.
Is a spoofed caller ID the same thing as vishing?
No. Caller-ID spoofing is a delivery technique — it makes the calling number display a value the caller does not own. Vishing is the fraud pattern of extracting information verbally from a person over a call. Vishing campaigns very often use spoofed caller IDs, but a spoofed display alone does not make a call vishing; the defining property is the fraudulent impersonation and the extraction attempt.
What can a business do to protect its own customers from impersonation?
Three tenant-owned controls cover most of it. Authenticate your sending domains with SPF, DKIM, and DMARC so receiving servers can distinguish your mail from forged look-alikes. Register your brand names, domains, and sender IDs on an impersonation watchlist and open takedown cases when hostile candidates appear. And make sure your own sends carry the signals recipients can verify — identity headers on email, attestation on voice, a registered sender identity on SMS.