Lesson 5.7: Phone, SMS and QR phishing
Phishing doesn't need e-mail. Vishing uses phone calls (often to the helpdesk), smishing uses text messages, and quishing hides the link in a QR code, which moves the victim to a phone outside the company's protections. The levers are the same as in 1.3 and so is the defence: recognise the pressure, read the real address, verify through a channel you already know. In the lab you analyse this week's reported texts and QR codes, review two suspicious helpdesk calls, and build a block list.
16 min
You will learn to
- Define vishing, smishing and quishing
- Extract and read links from texts and QR codes
- Recognise helpdesk social engineering
- Explain call-back verification
- Build a block list from reports
Key terms
- Vishing
- Voice phishing: manipulation by phone call, increasingly with spoofed caller IDs or cloned voices.
- Smishing
- Phishing by SMS or messaging app.
- Quishing
- Phishing through a QR code, in e-mail, documents or on physical posters.
- Caller ID spoofing
- Faking the number shown to the person being called.
- Call-back verification
- Ending the call and calling the person back on a number from a trusted source, such as the company directory.
← More ways to look at text: head, tail, wc, sort and uniq · All lessons · DNS: the internet's phone book →