Phishing calls & texts

How it works

Phone phishing ("vishing" by voice, "smishing" by text) impersonates a company you trust — your bank, a courier, a streaming service — to trick you into revealing credentials, one-time codes, or card numbers. Texts typically carry a link to a fake login page; calls create urgency and ask you to 'verify' details a real company would never request.

The one-time passcode variant is the most dangerous: the scammer triggers a real security code to your phone, then calls pretending to be the company and asks you to read it back. Anyone who asks you to share a code sent to your phone is a scammer, without exception.

If you get one

• Never tap links in unexpected texts — go to the company's site or app directly.
• Never read a one-time code to a caller. No legitimate company asks for it.
• If in doubt, hang up and call the number on the back of your card.