Module 3 · 3.4

English ▾

Nederlands English Deutsch

Phishing by text, chat, phone and QR code

Module 3: Recognising phishing · Reading time: 12 minutes

Learning goal: After this lesson you can recognise phishing outside email: via text messages and chat apps, on the phone (including with a cloned voice), via QR codes, and via a flood of login notifications, and you know how to check each channel.
Key concepts: smishing, friend-in-need fraud, vishing, number spoofing, fake helpdesk, voice clone, quishing, MFA bombing

Why other channels work so well

Everything from lesson 3.1 applies here too: urgency, authority, fear, curiosity and reward. But outside email, the tricks often work even better:

On the phone, you read quickly. The screen is small, addresses get cut off, and you're often in the middle of something else.
There's less technology to help. A mail server checks SPF, DKIM and DMARC and has a spam filter. For text messages, chat and phone calls, there's much less of that.
It feels more personal. A message in a chat app or a voice on the phone inspires more trust than an email.
It's live. A caller can probe further, pile on the pressure and walk you through it step by step.

The reflex stays the same: stop, check via your own route, ask. What differs per channel is what that check looks like.

Text and chat: smishing and friend-in-need fraud

Smishing is phishing by text message. Scammers pose as an organisation you might expect a text from: a courier, your bank, a government service, your energy supplier. According to the NCSC, the same thing happens via chat apps such as WhatsApp and Telegram.

A typical example:

Courier service: your parcel could not be delivered due to an incomplete address. Arrange a new delivery: https://koeriersdienst.track-nl.example/z8K

Read the link as in lesson 3.2: the registrable domain is track-nl.example, and so not koeriersdienst.example belonging to the courier. On a phone this is extra tricky, because you only see the start. Press and hold a link to see the full address, or don't open it and go to the courier's app or site yourself.

The sender's number or name proves nothing. Text senders and phone numbers can be faked (spoofing). A fake message can therefore appear in the same text thread as genuine messages from that sender. So a familiar name above a message is no proof either.

Friend-in-need fraud happens via chat apps:

Hi, this is my new number, my phone is broken. Could you make a payment for me? I'll pay you back tomorrow. It needs to happen today.

In a business, the same trick appears as a message from "the director" or "a colleague" with a new number, wanting a quick payment or gift cards. Check: call or message the person on their old, known number, or ask a question only the real person can answer.

The phone: vishing, fake helpdesks and cloned voices

Vishing (voice phishing) is phishing by phone. Three forms are common.

The bank employee. Someone calls on behalf of the bank or the "fraud department": there are suspicious payments, your money needs to be made "safe", or you need to pass on a code or approve a payment in your banking app. Your screen sometimes even shows the bank's real number. That too can be spoofed. A real bank never asks for your login codes or for you to transfer money to a "safe account".

The fake helpdesk. Someone calls on behalf of a software supplier, your internet provider or your IT company: your computer is infected, there's a problem with your account. They ask you to install a program so they can look in remotely. This lets them take over your computer. The NCSC puts it simply: never just give someone remote access to your devices.

The cloned voice. AI can mimic a voice from audio recordings, for example from a video or voicemail. A cloned voice of your director or a family member can then call with an urgent request. So you can no longer blindly trust your ears.

What works for all three:

Hang up as soon as pressure builds or you're asked for codes, money or access. That's not rude.
Call back yourself on a number you look up or already had: the back of your bank card, the official site, your own contact list. Not the number the caller gives you.
Agree a check question or codeword with the people who could ask you for money, such as management and accounting. Also agree that payments are never made on the basis of a phone call alone (lesson 1.2).

QR codes: quishing

A QR code is simply a link you can't read. Quishing is phishing with a QR code. Two forms:

In public or in a room. A sticker with a fake QR code over the real one, on a parking meter, a charging point, a menu or a poster. You think you're paying the parking app, but you're entering your card details on a fake site.
In an email or PDF. "Scan this code to confirm your mailbox." A QR code in an image can't be checked with your mouse. And you scan it with your phone, where it's harder to read addresses.

The NCSC advises, among other things:

Don't scan a QR code without accompanying text or an image, and be careful with codes in public places.
Check whether the code is genuinely printed on the poster or sign, or whether a sticker has been stuck on top.
Use a scanner that first shows you which address or domain you're going to. In newer versions of Android and iOS, the camera does this by default.
If you don't recognise the address, don't proceed. Don't enter a password or payment details unless you're sure the site is genuine.

Look at the registrable domain in the address example shown by the camera, exactly as in lesson 3.2. At a parking meter, you can also use the official parking app or the address printed on the sign itself.

MFA bombing: when your phone keeps buzzing

Many services send a notification to your phone when logging in: "Trying to log in? Approve or deny." If an attacker already has your password, they'll try to log in again and again. Your phone gets one notification after another, sometimes in the middle of the night. This is called MFA bombing (also MFA fatigue). The attacker hopes that out of irritation or by mistake you'll tap Approve. Sometimes they'll also call or message you as "helpdesk": "We're restoring your account, just tap approve."

What to do:

Never approve a notification you didn't start yourself. Not even if someone asks you to.
Treat it as an alarm. An unexpected login notification means someone has your password. Change the password for that account immediately, via the site or app itself.
Check the active sessions and log out any unknown sessions (lesson 2.5).
Choose a stronger form of two-factor authentication (2FA) if available. With number matching, you have to type a number from the login screen into the app; you can't simply approve a notification that doesn't have that screen in front of you. Passkeys and security keys (lesson 2.4) are even stronger, because they don't work on a fake site.

In practice: what it looks like

In My WebOké, under active sessions, you can see where and when you're logged in, and log out other sessions (WebOké guide 3.6). Other services, such as your mail program, accounting software or Nextcloud, have a similar overview under your account's security settings. Check there first after an unexpected login notification.

Summary

Outside email, the same tricks work, but there's less technology to help and you read faster.
A number or sender name on your screen proves nothing: these can be spoofed.
On the phone: hang up, call back yourself on a known number, never give codes, money or remote access. Even a familiar voice can be cloned.
QR codes: look for stickers, let the camera show the address, and read the registrable domain.
An unexpected login notification is an alarm: deny it, change your password, check your sessions.

Quiz

1. You receive a text message that appears in the same thread as earlier genuine messages from your bank. What does this tell you? That the message is genuinely from the bank
That your bank has checked the link
Nothing for certain: a text message's sender name can be spoofed
That the link is safe if it starts with https

Through spoofing, a fake message can end up among genuine messages. Go to the bank's app or site yourself.

2. Someone calls on behalf of your bank's "fraud department". Your screen shows the bank's real number. They ask you to approve a payment to keep your money safe. What do you do? Approve it, because the number is correct
Hang up and call the bank yourself on the number from your card or the official site
Ask for their staff number and then approve it
Approve the payment and then call the bank

A number on your screen can be spoofed. A real bank never asks you to transfer money to a "safe account".

3. At 3am, your phone shows the notification "Trying to log in?" five times. What's the best response? Approve it once, then the notifications will stop
Deny all of them, change the password for that account, and check the active sessions
Delete the app from your phone
Do nothing, it's probably a glitch

Someone has your password and is hoping you'll approve a notification. Denying alone isn't enough: the password is already known.

4. A parking meter has a QR code that's slightly crooked and sticks out a bit. What's wisest? Scan it and pay quickly before you get a fine
Scan it and check whether the page looks professional
Don't use the code, and pay via the official app or the address printed on the sign itself
Scan the code with a different phone

A sticker placed over the real code is a known form of quishing. Use a route you choose yourself.

5. Why does an agreed codeword help against a cloned voice? Because AI can't pronounce codewords
Because it encrypts the call
Because the phone checks the codeword
Because the attacker can mimic the voice, but doesn't know the codeword

A voice can be cloned from recordings. A secret only the two of you know is in no recording.

Exercise

Exercise A3.4: Reading a QR code without opening it. The program shows a QR code. Scan it with your phone's camera, but do not open the link. Read the address the camera shows and enter the registrable domain, and whether you would open the link. The program checks it.

Exercise A3.4: Reading a QR code without opening it

Scan the QR code that appears after loading with your phone's camera, but don't tap the link. The address goes to a practice domain that doesn't exist anywhere; even if you accidentally open it, nothing happens. If scanning doesn't work, choose Other scenarios.

Registrable domain in the QR code

Would you open this link in this situation?

What you enter and what we find isn't stored. Your browser remembers your answers and whether you've passed the exercise. If you're signed in, we only save that you got the exercise (almost) right in My courses; you can delete that there too.

Exercise D3.4: Agreements for phone, chat and sign-in alerts. Agree with your team on calling back, a check question or codeword, and what to do with an unexpected login notification. Then check on your own phone whether the camera shows the address of a QR code before opening anything.

Exercise D3.4: Agreements for phone, chat and sign-in alerts

How to tackle it: (1) Agree with the people who make or approve payments that a request for money, an IBAN change or codes is never carried out based on phone, text message or chat alone. Calling back always happens on a number from your own records or contact list. (2) Agree on a security question or codeword for urgent requests from management or family. Don't write the codeword down anywhere digitally where an attacker could read it. (3) Agree what everyone does in response to an unexpected sign-in alert or a series of alerts: refuse, report, change password, check sessions (lesson 2.5). (4) Check on your own phone whether the camera shows the address first when scanning a QR code, and only opens it when you tap. Use a QR code from a known, trusted source for this (for example a code you make yourself for https://www.example.com). (5) Check whether your chat app and your most important accounts have extra protection you're not yet using (for example two-factor authentication with a PIN, number matching for sign-in alerts, or a passkey) and turn it on.

Agreement "money and codes never by phone or chat alone" made and shared
Call-back numbers for important suppliers and the bank are in our own records
Security question or codeword agreed
Everyone knows what to do in response to an unexpected sign-in alert
Tested my phone's camera: shows the address before opening
Extra protection checked in chat app and key accounts

Who in your business would an attacker call to get a payment released, and what would they say?

Which of the agreements above is hardest to maintain in your business, and why?

Also save my answers in My courses (so you can view and download them on any device). Don't include any passwords or other secrets.

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing