Phishing Variants (Spear Phishing, Whaling, Vishing, Smishing)

Phishing is the broader practice of impersonating a trusted source to obtain information, money or access. Its variants describe targeting or communication channels. Spear phishing is tailored to a particular person or group; whaling focuses on senior or high-value targets; vishing uses voice calls; and smishing uses text messages. One attempt can fit more than one category—for example, a targeted call to a company owner.

A small business may see a fake vendor invoice, a text pretending to be a delivery problem or a caller claiming to be its bank. Familiar branding and details from public profiles can make a request seem authentic, so spelling mistakes are not a reliable sole warning sign. Staff should verify unusual payment or credential requests through an independently obtained contact channel, use phishing-resistant authentication where practical and report suspicious messages.

This entry is a taxonomy and response guide, not a replacement for the original Master’s Phishing definition. Whether separate publication is warranted depends on how thoroughly that existing article already explains the variants. Also distinguish a phishing simulation, which is an authorized training exercise, from an actual malicious attempt.