Recognize QR-code and text-message phishing

Email filters got good, so attackers moved to channels with fewer

filters: your text messages and your camera. The psychology is

identical to email [[phishing]] (KB-0021) — urgency, impersonation,

a link — just wearing a different coat.

Text-message phishing ("smishing")

The classics: a missed package delivery needing a small fee,

your bank flagging suspicious activity, a toll or fine

unpaid, your boss texting from a "new number" needing

something urgent (that one's KB-0134's gift-card scam arriving by

SMS).

The tells and the response:

1. Real organizations don't resolve account problems via a link in

a text. When in doubt, go direct: type the company's website

yourself or use their app — never the texted link.

1. Urgency + a link + a payment = scam, as a near-law.
2. Don't reply (even "STOP" confirms a live number to scammers —

that guidance is for legitimate senders you recognize).

1. Delete it; on a work phone or about a work matter, report it

like any phish (KB-0030 if anything was clicked or entered).

QR-code phishing ("quishing")

A QR code is just a link you can't read before opening — which is

the entire attack. Hostile codes arrive in emails ("scan to hear

your voicemail"), on parking meters and posters (stickers pasted

over the real code), and in fake invoices.

1. Treat scanning like clicking (KB-0021's link rules): check

the preview URL your camera shows before opening, and stop if

it's a shortener or a mismatched domain.

1. Be extra wary of QR codes in emails — a code where a link

would do usually exists to dodge the email filters.

1. A scanned page asking you to sign in is the trap itself —

close it; if you entered anything, act per KB-0030 now.

The portable rule

New channel, same con: pressure plus a link plus credentials or

payment. The channel changes; the ten seconds of suspicion

(KB-0021) never do.