X or Y? The attacks people mix up

17 pairs of attacks that look alike enough to be confused, side by side. For each: what each attack does in plain terms, what sets it apart from the other, and the criterion that tells them apart. The text is the articles' own, where each pair also appears under “Not to be confused with”.

Why tell them apart

Two similar attacks are not always defeated the same way: the right reflex, and the steps if it already happened, depend on which one is under way. Each name below leads to its article.

I'm unsure about…17 pairs

Vishing (voice phishing) or Fake bank advisor?

Vishing (voice phishing)	Fake bank advisor
In plain termsPhishing by voice. Nothing is written, nothing can be reread, and the caller moves at their own pace while you have to respond at yours. That imbalance is what makes it work.	In plain termsSomeone calls you claiming to be your bank's anti-fraud department and asks you to validate an operation to "block it." By validating, you are the one authorizing the scammer's transfer.
Compared with the otherThe technique: getting information or actions out of you during a phone call, whoever the caller claims to be.	Compared with the otherOne specific vishing scenario: a fake bank fraud department gets you to approve a transaction yourself.

What tells them apart: Vishing is the method; the fake bank advisor is one way of staging it, with its own steps to take with your bank.

Practice: Vishing (voice phishing)Practice: Fake bank advisor

Identity impersonation or Identity theft?

Identity impersonation	Identity theft
In plain termsSomeone pretends to be a person or organization you know, for the length of one exchange, in order to obtain from you something you wouldn't grant to a stranger.	In plain termsSomeone acts in your name over time: a loan opened, a subscription taken out, a filing made. You usually find out through a reminder letter about something you never asked for.
Compared with the otherA means: someone poses as a person or an organisation for the length of an exchange.	Compared with the otherA harm: someone acts in your name over time — a loan, a subscription, a formality.

What tells them apart: Impersonation deceives the person being spoken to; identity theft makes you appear responsible for acts you did not carry out.

Phishing or Smishing (SMS phishing)?

Phishing	Smishing (SMS phishing)
In plain termsAn email that looks like it's from your bank, the tax office, or a service you use asks you to log in. The link leads to a copy of the site, and whatever you type there goes straight to the scammer.	In plain termsThe same trap as phishing, but by text message. The message looks like it's from your bank, and the link leads to a fake page. On a phone, the address is truncated — which is what makes SMS more effective than email for this.
Compared with the otherThe principle: a message that imitates a legitimate sender to obtain your credentials or bank details, most often by email.	Compared with the otherThe same method by text message, on a screen where the link's address is often cut short.

What tells them apart: Smishing is not a different scam: it is phishing by text message. What changes is what you can check on a phone.

Practice: Phishing Practice: Smishing (SMS phishing)

Phishing or Vishing (voice phishing)?

Phishing	Vishing (voice phishing)
In plain termsAn email that looks like it's from your bank, the tax office, or a service you use asks you to log in. The link leads to a copy of the site, and whatever you type there goes straight to the scammer.	In plain termsPhishing by voice. Nothing is written, nothing can be reread, and the caller moves at their own pace while you have to respond at yours. That imbalance is what makes it work.
Compared with the otherThe principle, most often in writing: a message, a link, a page you can inspect.	Compared with the otherThe same method by voice: nothing is written down, nothing can be reread, and the caller sets the pace.

What tells them apart: A call has no link to inspect: the only possible check is to hang up and call the organisation back on a number you already know.

Practice: Phishing Practice: Vishing (voice phishing)

Phishing or Quishing (fraudulent QR code)?

Phishing	Quishing (fraudulent QR code)
In plain termsAn email that looks like it's from your bank, the tax office, or a service you use asks you to log in. The link leads to a copy of the site, and whatever you type there goes straight to the scammer.	In plain termsA QR code doesn't show where it leads. A sticker placed on a parking meter or a terminal is enough to send people to a fake payment page.
Compared with the otherThe principle, inside a message you receive: the link's address can be read before it is opened.	Compared with the otherThe same method through a QR code, often away from any screen: a poster, a parking meter, a letter. The code hides the address.

What tells them apart: With a QR code, the address can only be read once the code is scanned: that is the moment to check it, before opening the page.

Practice: Phishing Practice: Quishing (fraudulent QR code)

Fake tech support or Scareware?

Fake tech support	Scareware
In plain termsA full-screen alert claims your computer is infected and displays a number to call. On the phone, a fake technician talks you into installing software that hands them control of your machine.	In plain termsA dramatic alert announces that your device is infected and offers the software that will fix it. The infection doesn't exist; the only malicious program in the whole story is the one being sold to you.
Compared with the otherA person: a fake technician, on the phone, gets remote control of your computer or a payment.	Compared with the otherA program or a web page: a fake alert sells or installs a so-called fix.

What tells them apart: They often follow one another — the alert shows a number, the number leads to the fake technician — but they are not the same: in one case you close the page, in the other you hang up.

Practice: Fake tech support Practice: Scareware

Spyware or Stalkerware (surveillance by someone close to you)?

Spyware	Stalkerware (surveillance by someone close to you)
In plain termsA program installed without your knowledge that watches what you do on your device and sends back what it sees. It doesn't break anything: its purpose is to last without being noticed.	In plain termsAn app installed on your phone by someone close to you, which forwards your messages, your location, and your calls. If you're in a situation involving abuse, don't remove it right away: its disappearance is noticeable, and get help first.
Compared with the otherA stranger, remotely, installs a program to watch your activity.	Compared with the otherSomeone close to you, with physical access to your phone, installs a surveillance app on it.

What tells them apart: The technique is the same, the situation is the opposite: with stalkerware, removing the app can alert the person watching you. Safety comes before clean-up.

Sextortion or Fake hacking blackmail?

Sextortion	Fake hacking blackmail
In plain termsSomeone claims to have intimate images of you and threatens to send them to people you know unless you pay. The threat is real in some cases, invented in many others — and in both, paying doesn't end the demand.	In plain termsAn email claims your webcam was hacked and that you were filmed. It sometimes quotes one of your old passwords to seem credible. Yet the message contains nothing that actually identifies you: it's sent unchanged to thousands of recipients.
Compared with the otherThe blackmailer has, or may have obtained, intimate images of you, and threatens to share them.	Compared with the otherNothing exists: a mass-mailed email claims your webcam filmed you.

What tells them apart: The first question to ask: did you actually share intimate images, or get filmed, with the person threatening you? Either way, paying does not end the demand.

Practice: Fake hacking blackmail

Computer Virus or Computer Worm?

Computer Virus	Computer Worm
In plain termsIn everyday use, "virus" refers to any piece of malware. Strictly speaking, it's a precise category: a program that copies itself into other files to spread.	In plain termsA program that spreads by itself from one device to another, without anyone opening or clicking anything. That's what makes it fast.
Compared with the otherA program that copies itself into other files and spreads when they are opened or shared.	Compared with the otherA program that spreads on its own through a network, with no host file and no user action.

What tells them apart: A virus waits for someone to open a file; a worm waits for no one, which is what makes it fast.

Computer Virus or Trojan Horse?

Computer Virus	Trojan Horse
In plain termsIn everyday use, "virus" refers to any piece of malware. Strictly speaking, it's a precise category: a program that copies itself into other files to spread.	In plain termsA program that does what it claims — and something else besides. You installed it yourself, voluntarily, because it looked useful.
Compared with the otherIt reproduces: it copies itself into other files to spread.	Compared with the otherIt doesn't reproduce: you install it yourself, because it presents itself as a useful program.

What tells them apart: A virus spreads from file to file; a trojan horse doesn't need to spread, since it gets itself run by the targeted person.

Practice: Trojan Horse

Computer Worm or Trojan Horse?

Computer Worm	Trojan Horse
In plain termsA program that spreads by itself from one device to another, without anyone opening or clicking anything. That's what makes it fast.	In plain termsA program that does what it claims — and something else besides. You installed it yourself, voluntarily, because it looked useful.
Compared with the otherIt moves by itself from one device to another, without anyone opening or installing anything.	Compared with the otherIt doesn't move: it waits to be installed, hidden in an apparently legitimate program.

What tells them apart: A worm spreads through its own autonomy; a trojan horse, through the trust of the person who installs it.

Practice: Trojan Horse

Hacked security camera or Compromised smart device?

Hacked security camera	Compromised smart device
In plain termsA camera installed to watch your home becomes a way of watching you instead. The intrusion leaves no visible trace: the feed keeps arriving normally.	In plain termsA bulb, plug, thermostat or connected toy has no screen and no notifications: if it's compromised, nothing will tell you. It keeps working normally.
Compared with the otherA surveillance camera a third party has gained access to: what is exposed is the inside of your home.	Compared with the otherA connected device with no screen — a bulb, a plug, a thermostat, a toy — that a third party has taken control of with nothing to signal it.

What tells them apart: The way in is often the same, a factory credential; what changes is what the intruder gets: images of your home with the camera, control of a device with other objects.

Practice: Hacked security camera

Compromised router or gateway or Compromised smart device?

Compromised router or gateway	Compromised smart device
In plain termsEverything your household does goes through the router. Compromised, it can send every device in the home to fake sites — without anything being installed on those devices.	In plain termsA bulb, plug, thermostat or connected toy has no screen and no notifications: if it's compromised, nothing will tell you. It keeps working normally.
Compared with the otherThe equipment all of the household's traffic goes through: compromised, it can redirect or observe the traffic of every device.	Compared with the otherA single device in the home, which a third party has taken control of.

What tells them apart: A compromised device is one device lost; a compromised router puts every device in the home at risk, without anything being installed on them.

AI misuse of photos or Non-consensual sharing of intimate images?

AI misuse of photos	Non-consensual sharing of intimate images
In plain termsOrdinary photos you posted — a portrait, a vacation picture — turned without your consent into intimate or compromising images. You never sent anything: they were public.	In plain termsIntimate images you had entrusted to someone are published or sent without your consent. There's no demand for money: the goal is to harm. It's a criminal offense, and you are the victim.
Compared with the otherImages manufactured from ordinary, public photos: the person never sent anything intimate.	Compared with the otherReal intimate images, entrusted to someone, published or sent without consent.

What tells them apart: AI misuse manufactures images that never existed; non-consensual sharing publishes real images obtained within a relationship of trust.

Practice: AI misuse of photos

Sextortion or Non-consensual sharing of intimate images?

Sextortion	Non-consensual sharing of intimate images
In plain termsSomeone claims to have intimate images of you and threatens to send them to people you know unless you pay. The threat is real in some cases, invented in many others — and in both, paying doesn't end the demand.	In plain termsIntimate images you had entrusted to someone are published or sent without your consent. There's no demand for money: the goal is to harm. It's a criminal offense, and you are the victim.
Compared with the otherA threat to distribute intimate content to obtain money, more images, or a continued relationship.	Compared with the otherThe distribution itself, with no demand for money: the goal is to harm.

What tells them apart: Sextortion threatens in order to get something; non-consensual sharing has already acted.

Wi-Fi Deauthentication Attack or Evil Twin Wi-Fi Hotspot?

Wi-Fi Deauthentication Attack	Evil Twin Wi-Fi Hotspot
In plain termsYour device is repeatedly disconnected from Wi-Fi until you choose another network. The drop isn't a glitch: it's the goal.	In plain termsA Wi-Fi network carrying the name you expect — the café's, the hotel's, the airport's — but belonging to someone else. Nothing distinguishes it from the real one in the list of networks.
Compared with the otherRepeated disconnections from Wi-Fi: they grant access to nothing, they set up something else.	Compared with the otherA network published under a name that imitates the real one, so that your traffic passes through it.

What tells them apart: Deauthentication drives you off your network; the fake access point is the one it pushes you towards.

Practice: Evil Twin Wi-Fi Hotspot

ARP Spoofing or Evil Twin Wi-Fi Hotspot?

ARP Spoofing	Evil Twin Wi-Fi Hotspot
In plain termsOn a network you've already joined, a device impersonates the router to your own. Your traffic is handed to it before being forwarded on.	In plain termsA Wi-Fi network carrying the name you expect — the café's, the hotel's, the airport's — but belonging to someone else. Nothing distinguishes it from the real one in the list of networks.
Compared with the otherOn a network you have already joined, a device impersonates the router.	Compared with the otherThe network itself is supplied by the third party, under a name that imitates the one you expect.

What tells them apart: ARP spoofing requires prior access to the network; with a fake access point, you are the one joining the attacker's network.