Two ways to sort them
Most confusion about phishing terminology comes from mixing two different classifications. Smishing describes a channel. Spear phishing describes a targeting method. A single attack can be both at once - a hand-written SMS aimed at one finance manager is spear phishing delivered by smishing.
Sorting them properly matters operationally, because the two axes call for different defences. Channel determines which control can even see the message; targeting determines how convincing it will be and how much damage one success causes.
By channel
| Name | Channel | Typical lure |
|---|---|---|
| Email phishing | Password expiry, shared document, unpaid invoice | |
| Smishing | SMS or messaging apps | Undelivered parcel, blocked card, small customs fee |
| Vishing | Phone call | Fraud department calling about a suspicious payment |
| Quishing | QR code | A code in a poster, invoice or email that opens a fake login |
| Collaboration phishing | Teams, Slack, Discord | A message from a colleague's compromised account |
| Angler phishing | Social media | A fake support account replying to a public complaint |
| Malvertising / SEO poisoning | Search results and ads | A sponsored result for a real product leading to a fake download |
Two of these are worth singling out. Quishing moves the victim onto a personal phone, where corporate filtering and link inspection usually do not reach. Vishing is where AI voice cloning has changed the picture fastest, because a familiar voice removes the doubt that written text leaves behind. Real examples across several of these channels are collected in phishing email examples.
By target
- Bulk phishing. The same message sent to a very large list. Low conversion, effectively zero cost, and still the most common form by volume.
- Spear phishing. Written for one person or one role using prior research - see spear phishing.
- Whaling. Spear phishing aimed at executives, where a single success authorises far more than an ordinary account could.
- Business email compromise. Impersonating a colleague, executive or supplier to redirect a payment, often with no link or attachment at all - see business email compromise.
- Supply-chain or vendor compromise. The message arrives from a genuine, trusted partner whose mailbox has been taken over, which defeats almost every sender-based check.
Cutting across both axes is the technique used once the victim engages - most notably real-time credential relay, covered in adversary-in-the-middle phishing. For the underlying definition, see what is phishing.