Quishing, Smishing and AI Voice Cloning: 2026 Scam Terms Explained

Security alerts now mix familiar threats with terms that rarely get a plain-English explanation: quishing, smishing, AI voice cloning. If you have paused on a bank warning or a text from a “delivery service” and wondered what made it dangerous, the confusion is not on you. This guide translates the 2026 scam vocabulary into short definitions and pairs each term with the number or behaviour that matters.

The mobile shift: smishing and quishing

Smishing is phishing delivered by SMS: a text message that impersonates a bank, courier, toll agency or job poster. Quishing is QR-code phishing: the attacker places a QR code in an email, text, poster or package, and the code sends you to a page designed to steal credentials or install malware. The two overlap heavily with voice follow-up and OTP theft, which is any attempt to capture the one-time passcode that should protect an account.

The mobile numbers make the pattern concrete. In APWG data, phishing delivered through social media and SMS rose from 15.4% to 17.3% quarter over quarter in late 2025. In Zimperium’s 2025 mobile telemetry, mishing — mobile-targeted phishing — accounted for roughly one-third of observed threats, and smishing represented more than two-thirds of that, with SMS making up 69.3% of observed mishing vectors. The FTC reported that U.S. consumers lost $470 million in 2024 to scams that started with text messages; fake package-delivery messages were the most common text scam, followed by bogus job offers, fake bank fraud alerts, toll notices and wrong-number scams.

AI voice cloning: the caller you can’t trust

AI voice cloning uses a short audio sample, often lifted from a public video or a brief phone call, to generate a believable real-time imitation of a voice. The attack usually borrows the pattern of vishing — voice phishing — with a familiar “relative” or “boss” who is urgent and needs money or credentials.

The warning signs are not in the audio quality. People cannot consistently identify deepfake voices, so treating every unexpected voice request as unverified is more reliable than relying on how authentic the caller sounds. Gartner found that 62% of organisations have already experienced a deepfake attack. SoSafe says successful vishing incidents cost an average of 1.5 million US dollars in incident response and describes the common patterns as CEO fraud, help desk manipulation, MFA pressure and phishing preparation. Detectors are mostly behavioural: time pressure, secrecy and a request to bypass a normal process. AI voice cloning attacks cannot be filtered technically; they are trained against through awareness and verification habits.

The numbers behind the glossary

These terms are not niche. The FBI’s IC3 received 1,008,597 cybercrime complaints in 2025, the first time the total has passed a million. Phishing/spoofing was the most-reported crime type at 191,561 complaints, more than extortion (89,129) and investment fraud (72,984) combined, and total reported cybercrime losses reached 20.9 billion US dollars, up 26% from 16.6 billion in 2024. Reported phishing and spoofing losses reached 215.8 million US dollars in 2025, roughly triple the 70 million reported in 2024, even as complaint volume stayed nearly flat.

The speed is part of the risk. The median time to click a phishing link is about 21 seconds after a message is opened, and roughly 28 more seconds to enter data — under a minute from open to compromise. APWG observed 971,181 phishing attacks in Q1 2026, up 13.8% from Q4 2025. Separately, the FBI logged 22,364 AI-related complaints with 893.3 million US dollars in associated losses in its 2025 report.

Make the vocabulary stick

Definitions help most when you can recall them mid-alert. A simple memory hook: smishing is SMS plus phishing, quishing is QR plus phishing, and vishing is voice plus phishing. If these terms still feel dense outside a live warning, word meanings offers plain definitions, example sentences and practice exercises for the kind of vocabulary that appears in fraud alerts, so the language becomes familiar instead of alarming.

Final checks when a message feels wrong

The safest response is rarely the one the message demands. For an unsolicited text, do not tap the link; instead open your bank or courier app directly or call a number you find on the official site. For a QR code, preview the destination URL before proceeding, and when in doubt, type the address manually. For a voice call, hang up and call back on a number you already trust. NIST designates SMS-based one-time passcodes as restricted authenticators, and CISA recommends moving toward phishing-resistant MFA, with number matching as a fallback where stronger options are not yet deployed. When a caller or sender creates time pressure or asks you to keep the request secret, that is a known manipulation signal, not a reason to act quickly.