Smishing and QR code scams: how to train staff

Staff carry their phones everywhere. That makes texts and QR codes an easy door for scammers. They skip your email filters and land where people are less careful.

Smishing and QR code scams are phishing on a phone. Here is how to spot them and what to teach your team.

What are smishing and quishing?

Smishing is phishing by text. Quishing is phishing by QR code. Both try to make you tap or scan without thinking.

• Smishing: “Your parcel is held. Pay a small fee here.”
• Quishing: “Scan to claim your prize” or “Scan to update your payroll.”

The FTC says phishing messages often claim a problem with your account, ask you to confirm information, or offer a link to make a payment. NIST also warns that phishing is not only email. It can come by text, call, social media or mail.

What do work-related scam texts look like?

They claim a locked account, a held parcel, a boss in a meeting, held pay or an HR notice. Five to watch for:

1. “Your account is locked. Verify here.” (Bank or work login.)
2. “Package could not be delivered. Pay a fee.”
3. “Hi, it’s your manager. I am in a meeting. Need a favour.” (Gift cards or transfers.)
4. “Your salary has been held. Confirm your details.”
5. “HR notice: update your benefits.” (Fake link.)

Each one has a rush, a reason that sounds real, and a link or a request. CISA’s four signs of phishing fit all five: urgent language, a request for personal or financial information, untrusted shortened links, and addresses that imitate real ones.

What is the safe habit for a scam text?

Stop, go direct, tell. It takes ten seconds.

1. Stop. Do not tap the link or reply.
2. Go direct. Open the real app or type the site yourself. Or call a number you already have. The FTC gives the same advice: contact the company using details you know are real, not those in the message.
3. Tell. Forward it to IT or your manager.

What are the QR code rules for staff?

Scan only what you expect, and check the address before you sign in.

• Scan only codes you expected, from a source you trust.
• Look at the web address that opens. Does it match the company?
• Never log in after scanning a poster, sticker or flyer.
• If a QR code is stuck over another one, leave it.
• Report strange codes in the workplace to IT.

A quick test: would this company really ask me to scan a code on a wall to sign in? If the answer is “I am not sure”, ask IT.

How do you report a scam text?

• US: forward the text to 7726 (SPAM) and report to ReportFraud.ftc.gov. Forward phishing emails to reportphishing@apwg.org.
• Nigeria: tell your bank at once if you shared card, BVN or OTP details. Tell your IT or data protection contact.
• At work: every time, tell your own IT or manager.

What if someone already tapped the link?

Do not panic and do not hide it. Tell IT right away, change the password for anything you typed in, and keep the text. Our guide what to do after clicking a phishing link has the steps.

See also WhatsApp scams at work and how to spot BVN and OTP scams at work. For the full training plan, read how to train employees to spot phishing.

Add it to your training

Our simulation program includes a QR-code “quishing” poster scenario, so staff can practise safely. Today every simulation is delivered by email, so the text and QR scenarios are written as email versions of those patterns. See the phishing simulation page or request a free phishing risk test.