Blog/Online scams

Scam, Fraud, Phishing or Hacking: What Is the Difference?

Scam, fraud, phishing and hacking are often used as if they mean the same thing. What each one means, how they overlap, and which response and reporting channel each needs.

CyberWatch AI28 September 2026 · 3 min read

A magnifying glass, an open notebook and a camera laid out on an old map

"I got scammed." "My account was hacked." "It was a phishing email." "The bank says it is fraud." People use these words interchangeably, and that is understandable, because in real attacks they often happen together. But they do mean different things, and knowing which one you are dealing with tells you what to do first and who to tell.

The four terms in one table

Term	What it means	Who takes the action
Scam	A trick that persuades you to give money, information or access.	You do, because you were deceived.
Phishing	A type of scam using fake messages or websites that imitate trusted organizations, mainly to steal passwords, codes or payment details.	You do, by clicking, entering or sharing.
Hacking	Getting into an account, device or system without permission.	The attacker does, often using something stolen earlier.
Fraud	The broad legal term for gaining money or advantage by deception, including using stolen details.	Either. Scams and misuse of stolen data are both fraud.

Scam

A scam relies on persuasion. Someone tells you a story, such as a prize, a problem with your account, a relative in trouble or an investment opportunity, and you act on it. You might pay a fake seller, share a code, or move money to a "safe account". Nothing was broken into; you were deceived. See our plain-English definition of an online scam for the main types.

Phishing

Phishing is a specific kind of scam. The message pretends to be from an organization you trust, such as your bank, a courier, your email provider or your employer, and usually leads to a fake page that collects your login, card details or codes. Variations have their own names:

Smishing: phishing by text message.
Vishing: phishing by voice call.
Quishing: phishing through a QR code.
Spear phishing: a targeted message written for a specific person or organization.

Hacking

Hacking means gaining access without permission. In everyday life, most "hacks" of personal accounts are not clever technical break-ins. They use a password that was stolen by phishing, leaked in a data breach and reused, or a code the victim was tricked into sharing. Once inside, the attacker can read messages, change settings, make purchases or impersonate you to your contacts.

Fraud

Fraud is the umbrella term that banks, police and courts use. It covers scams where you were tricked into paying (often called authorised fraud) and cases where someone used your details without your involvement, such as a stolen card number (unauthorised fraud). That distinction matters a great deal when you ask a bank for your money back.

How they combine in real attacks

Illustrative example · One attack, four labels

1. A text says your parcel is held and links to a fake courier page. (Phishing, a type of scam) 2. You enter your card details and email password on the page. (You were scammed) 3. The attacker signs into your email with that password. (Hacking) 4. They use your card and message your contacts asking for money. (Fraud, and more scams)

The lesson:

Stopping it at step 1 or 2 prevents everything that follows.
If it has already happened, you need to respond to each part: the money, the account and your contacts.

Which response each one needs

If this happened	Do this first	Report to
You paid or shared payment details	Call your bank or payment provider on its official number.	Your bank, then your national fraud service.
You entered a password or shared a code	Change the password, starting with your email, and turn on two-step verification.	The account provider; your IT team if it was a work account.
Your account was taken over	Use the provider's official recovery process and warn your contacts.	The platform, and your national service if money or identity was involved.
You received a phishing message but did nothing	Do not click. Delete it after reporting.	The "report phishing" option in your app, or your national reporting service.

For the right service in your country, see how to report a scam. For taken-over accounts, see your first hour after an account takeover.

Not sure what you are looking at? Paste the message or link into CyberWatch AI Scan for a free check before you act on it.

The words matter less than the response. For the full picture of how these attacks work and how to protect yourself, read the complete guide to online scams.

Frequently asked questions

Is phishing a scam?

Yes. Phishing is a type of scam that uses fake messages or websites, usually pretending to be a trusted organization, to trick you into giving away passwords, codes, card details or money.

Is being hacked the same as being scammed?

Not exactly. You are scammed when you are tricked into acting. You are hacked when someone gets into your account or device without permission. The two often happen together, for example when a phishing scam leads to an account being hacked.

Does it matter which word I use when I report?

Not much. Describe what happened in plain language: what you received, what you did, and what was lost. The service will classify it.