The terms phishing, vishing, and deepfake attacks are often grouped together and sometimes even used interchangeably. But they are not simply different versions of the same attack.
They operate through different channels, exploit different forms of trust, and require different defenses.
An employee who knows how to spot a suspicious email may still approve a payment after hearing a familiar cloned voice or follow instructions from someone who appears to be a known executive on a video call.
Understanding the difference matters because modern social engineering rarely stays inside a single channel.
Where the three attacks differ
Phishing is social engineering delivered through written communication, most commonly email. The attacker impersonates a trusted sender to convince the recipient to click a link, provide credentials, or authorize a payment.
Vishing follows the same basic logic but moves the interaction to a voice channel. The attacker calls while posing as a bank, IT support, a vendor, or a senior executive and uses live pressure to influence the target.
A deepfake attack goes further by impersonating a specific real person through AI-generated voice or video.
That distinction is important: phishing and vishing mainly describe how the attack is delivered, while deepfake technology describes what identity is being fabricated.
| Phishing | Vishing | Deepfake attack | |
| Channel | Email, chat, collaboration tools | Phone call | Video call or voice call using cloned audio |
| What is faked | Sender identity, document, or webpage | Caller identity and persona | A specific person’s face or voice |
| Typical request | Click a link, enter credentials, open an attachment | Read out a code, approve MFA, install remote access | Approve a payment, grant access, confirm a transaction |
| Why it works | Familiarity, plausibility, volume | Urgency and real-time pressure | rust in a recognizable face or voice |
| What helps stop it | Verifying the sender and destination before acting | Ending the call and calling back through a trusted number | Confirming the request through an independent channel |
How AI has changed phishing
Phishing remains one of the highest-volume forms of social engineering, but the messages reaching inboxes today look very different from the examples many awareness programs were designed around.
Generative AI has removed many of the traditional warning signs. Poor grammar, awkward phrasing, generic greetings, and obviously unnatural language are no longer reliable indicators.
It has also made personalization much easier. Public information about projects, suppliers, executives, reporting lines, and company structure can be turned into a convincing message with very little effort.
Two changes are especially important for training:
- Longer conversational attacks. The attacker may begin with a harmless exchange and build trust over several messages before introducing the malicious request.
- Multi-stage attacks without a direct link. In scenarios such as ClickFix, the target is instructed to run a command, paste something into a terminal, or perform a supposed fix manually. There may be no malicious attachment or URL to block.
If phishing simulations still focus only on single-message credential harvesting, they test resilience against a narrower attack model than the one employees are increasingly likely to face.
Why vishing is becoming more important
Vishing, or voice phishing, is a social engineering attack carried out over the phone. The attacker may impersonate IT support, finance, a supplier, or a senior executive and attempt to obtain credentials, trigger an MFA approval, or convince the target to install remote-access software.
Malware is not always necessary. A believable story and a few minutes of pressure can be enough.
Recent industry reports show how quickly this vector is growing. CrowdStrike reported that vishing activity in 2025 was on track to roughly double the previous year’s volume. M-Trends 2026 ranked vishing as the second most common initial infection vector, accounting for 11% of intrusions and trailing only vulnerability exploitation. Verizon’s 2026 DBIR also found that phone-centric social engineering simulations produced around 40% higher interaction rates than traditional email-based simulations.
Part of the reason is the format itself. Email gives the recipient time to stop, reread, and verify. A phone call creates immediate social pressure and forces decisions to be made in real time.
Common techniques include:
- caller ID spoofing;
- manufactured urgency;
- help desk impersonation;
- pretexts built from public information about employees, suppliers, and internal processes.
An attacker may already know the name of a manager, a vendor, or a company process before the call begins. That makes even a relatively simple script much more convincing.
When the attacker looks or sounds familiar
Deepfake attacks change the equation by impersonating a specific person with AI-generated voice or video. The difference is subtle but important.
In a typical vishing call, the attacker might say, “This is IT support.” With a deepfake, the target may hear the voice of their own CFO or see what appears to be that executive on a video call.
The attack no longer relies only on claimed authority.
It relies on recognition.
Deepfakes are also not a separate communication channel. They are a capability that can be added to existing attack methods.
A cloned voice can strengthen a vishing call. A synthetic face can make a video meeting convincing enough to undermine one of the most common verification habits: getting the person on camera.
The barrier to creating these materials has fallen rapidly. Short public audio samples may be enough to build a usable voice replica, turning interviews, webinars, conference appearances, and podcasts into potential source material.
Research has also shown a sharp increase in deepfake-enabled fraud attempts, with executive impersonation accounting for a significant share of documented losses.
How a deepfake video call can unfold
A deepfake video call replaces the attacker’s real camera feed with a synthetic version of someone the target knows.
The goal is to use that borrowed credibility to push an urgent request through in real time.
A typical sequence may look like this:
- Reconnaissance. Public video and audio of the target executive are collected and used to build the persona.
- The invitation. A phishing email or calendar request creates the pretext for an urgent meeting.
- The call. The synthetic executive appears on screen and delivers the request. Technical glitches or chat messages may be used to support the illusion.
- The action. The target is asked to approve a payment, provide access, open a resource, or perform another high-impact task.
One of the best-known examples involved a finance employee in Hong Kong who authorized transfers worth roughly $25 million after joining a video conference where the CFO and other participants were synthetic.
The difficult part is that employees cannot reliably be trained to identify every deepfake visually.
Some simple checks, such as asking the person to turn sideways or move a hand across their face, may still disrupt certain real-time systems, but these should be treated as prompts to verify, not as proof of authenticity.
The stronger defense is procedural.
No face and no voice should be enough on their own to authorize money, access, or another critical action.
Training needs to follow the attack chain
Asking which of these vectors should be trained first misses the bigger point.
Attackers do not need to choose only one.
A single campaign can begin with spear phishing, move into a phone call, and end with a deepfake video meeting. Each channel reinforces the previous one and can be used to bypass the verification step that would normally stop the attack.
Training should reflect that reality.
| Priority | What to test | Why it matters |
| Baseline | Email phishing, including conversational and multi-stage scenarios | Still the highest-volume channel and a common starting point for more complex attacks |
| High | Vishing across different employee groups, not only executives | Creates strong real-time pressure and continues to grow quickly |
| Strategic | Deepfake video calls and executive impersonation | Can bypass familiar identity-verification habits and lead to high-impact losses |
Conclusion
Phishing, vishing, and deepfake attacks should not be treated as three isolated categories.
Phishing uses written communication. Vishing moves social engineering into a voice channel. Deepfakes add a synthetic identity that may look or sound exactly like someone the target already knows.
That is why training on only one attack type leaves major gaps.
Vishing has become an increasingly important initial access vector, while phone-based simulations consistently show how effective real-time pressure can be. Deepfakes make the problem harder still because they can undermine the very verification method people often rely on when something feels suspicious: hearing or seeing the person directly.
The goal of modern awareness training should therefore not be to teach employees to “spot a deepfake” or memorize one perfect phishing indicator.
The more durable skill is verification.
A sensitive request should still be checked independently, no matter how polished the email looks, how familiar the voice sounds, or how convincing the person appears on screen.
Modern attacks move between text, voice, and video. Training needs to move with them.
