Phishing, Vishing, Smishing and Other Social Engineering Attacks Compared

Updated 1 Nov 2026 · 6 min read

On this page

What counts as social engineering
The phishing family: sorted by channel and target
BEC, impersonation and pretexting
Attacks that wait for you: watering holes and typosquatting
In-person attacks: tailgating, shoulder surfing and dumpster diving
Worked example: taking one attack apart
How this fits your exam
Frequently asked questions
Sources

By the end of this guide you will be able to tell apart the social engineering attacks named in the CompTIA Security+ SY0-701 and A+ 220-1202 objectives, using one distinguishing clue for each: the channel, the target, the claimed identity, or the place the attack happens. Each definition comes from NIST, Microsoft, ICANN or the US Federal Trade Commission.

NIST SP 800-171 Rev. 3 defines social engineering as "an attempt to deceive an individual into revealing information or taking an action that can be used to breach, compromise, or otherwise adversely impact a system." The same passage lists phishing, pretexting, impersonation, baiting, quid pro quo, threadjacking, social media exploitation and tailgating as forms of it.

The common thread in that definition is deception: the victim is led to reveal something or to act. The terms below differ mainly in how the deception reaches the victim and who it is aimed at.

The phishing family: sorted by channel and target

NIST's glossary, quoting SP 800-12 Rev. 1, defines phishing as an attempt to acquire sensitive data "through a fraudulent solicitation in email or on a web site, in which the perpetrator masquerades as a legitimate business or reputable person." The variants change either the channel or the target.

Term	Distinguishing clue	Source
Phishing	A fraudulent email or website posing as a legitimate business or person	NIST glossary
Spear phishing	Targeted, with highly customised lure content based on reconnaissance of the target	Microsoft Learn
Whaling	Phishing directed at high-level or senior executives	Microsoft Learn
Vishing	Phishing by phone call	Microsoft
Smishing	Phishing by SMS text message	Microsoft
QR code phishing	The link is embedded in a QR code	Microsoft Learn

Microsoft describes spear phishing as "a targeted phishing attack that involves highly customized lure content", where attackers "typically do reconnaissance work by surveying social media and other information sources about their intended target." Whaling is "a form of phishing directed at high-level or senior executives within specific companies to gain access to their credentials and/or bank information." NIST SP 800-53 Rev. 5 also talks about "spear or whale phishing attacks targeted at senior leaders or executives."

For the channel variants, Microsoft defines vishing as "phishing via phone calls to collect sensitive information" and smishing as "phishing via SMS". Its Defender for Office 365 documentation describes blocking "QR code based phishing attacks" and filtering email "with URLs embedded within QR codes".

BEC, impersonation and pretexting

These three overlap, so learn what each one names. Impersonation names the false identity. Microsoft's anti-phishing documentation says impersonation "is where the sender or the sender's email domain in a message looks similar to a real sender or domain", and gives contosososo.com as a possible impersonation of contoso.com. Brand impersonation, which SY0-701 lists separately, applies the same trick to a company: Microsoft notes that phishers impersonate trustworthy sources, naming well-known companies, to trick you into taking action.

Pretexting names the invented story. In a 2008 case about stolen phone records, the FTC described pretexting as using "false pretenses, fraudulent statements, fraudulent or stolen documents or other misrepresentations, including posing as an account holder or as an employee" of a phone company to obtain the records.

Business email compromise names the goal and the channel. Microsoft Learn says BEC "uses forged trusted senders (financial officers, customers, trusted partners, etc.) to trick recipients into approving payments, transferring funds, or revealing customer data." The combination to look for is email, a trusted sender and a request to move money or data.

Attacks that wait for you: watering holes and typosquatting

Two attacks wait for the victim to come to them. A watering hole attack, as NIST defines it, is one where "the attacker infects websites that are frequently visited by members of the group being targeted", hoping to infect a visitor's computer. The clue is a site the target group already visits, now infected.

Typosquatting relies on mistakes. ICANN's DNS Security Facilitation Initiative report describes it as "subtle misspellings of domain name labels" that may be hard to spot, such as faceboook.com instead of facebook.com, and calls it "a common attack vector for phishing". The clue is a domain that is almost, but not quite, the real one.

In-person attacks: tailgating, shoulder surfing and dumpster diving

Term	What happens	Source
Tailgating or piggybacking	An unauthorised person follows an authorised person into a controlled facility	NIST SP 800-53 Rev. 5, PE-3(8)
Shoulder surfing	Someone views information on your screen, such as the password feedback as you type	NIST SP 800-171 Rev. 3, SP 800-53 Rev. 5
Dumpster diving	Sensitive hard copy that leaves an organisation without effective sanitisation is exposed to people searching discarded material	NIST SP 800-88 Rev. 2

NIST treats tailgating and piggybacking as one activity. Its control for access control vestibules says they are "designed to prevent unauthorized individuals from following authorized individuals into facilities with controlled access. This activity, also known as piggybacking or tailgating, results in unauthorized access to the facility."

For shoulder surfing, NIST's guidance on authentication feedback describes the threat of someone seeing what you enter on a large monitor, "commonly referred to as shoulder surfing", and gives displaying asterisks as a countermeasure. For dumpster diving, NIST SP 800-88 Rev. 2 warns that hard copy that leaves an organisation without sanitisation exposes "a significant vulnerability to 'dumpster divers' and overcurious employees."

Worked example: taking one attack apart

In 2024 Microsoft Threat Intelligence described a campaign by the group it tracks as Storm-1811. The attackers signed target email addresses up to many subscription services to flood the inbox. They then phoned the user, posing as IT support and offering to fix the spam, and talked the user into granting remote access through Quick Assist.

Part of the attack	Term
A phone call, not an email	Vishing (Microsoft calls this step voice phishing)
Claiming to be the company's IT support	Impersonation
The story about fixing the spam flood	Pretexting

One attack, three correct labels. When a question asks for the best answer, look for the detail the scenario stresses: the channel, the claimed identity, or the story.

How this fits your exam

CompTIA Security+ SY0-701 (objectives version 6.0): objective 2.2, "Explain common threat vectors and attack surfaces", lists human vectors/social engineering as phishing, vishing, smishing, misinformation/disinformation, impersonation, business email compromise, pretexting, watering hole, brand impersonation and typosquatting. Objective 5.6, "Given a scenario, implement security awareness practices", lists phishing "Campaigns", "Recognizing a phishing attempt" and "Responding to reported suspicious messages", and social engineering under user guidance and training. Objective 1.2 lists the access control vestibule under physical security. More in the Security+ SY0-701 study guide.

CompTIA A+ 220-1202 (objectives version 2.0): objective 2.5, "Compare and contrast common social engineering attacks, threats, and vulnerabilities", lists phishing with the sub-types vishing, smishing, QR code phishing, spear phishing and whaling, then shoulder surfing, tailgating, impersonation and dumpster diving. Business email compromise (BEC) appears under threats in the same objective. Objective 2.1 lists the access control vestibule under physical security. See the A+ 220-1202 study guide.

Frequently asked questions

What is the difference between phishing and spear phishing?

Phishing is the general technique of a fraudulent email or website posing as a legitimate business or person. Spear phishing is a targeted version with lure content customised to the intended victim, usually after the attacker has researched them through social media and other sources.

Are tailgating and piggybacking different attacks?

NIST SP 800-53 Rev. 5 treats them as the same activity: an unauthorised person following an authorised one into a controlled facility. Use the word tailgating in the A+ 220-1202 context, because that is the term its objectives list.

Is whaling the same as business email compromise?

No. Whaling describes who is targeted: senior executives. BEC describes the goal and method: forged trusted senders, which can include financial officers, used to get recipients to approve payments, transfer funds or reveal customer data. The two can connect: Microsoft notes that one of the most common BEC schemes starts with a spear phishing attack to gain access to the company's network.

Sources

Practise telling these apart with the free A+ 220-1202 practice questions, then work through the full A+ Core 2 guide.