From Phishing to Quishing: Know How to Spot the Bait

In brief:

• Learn how social-engineering scams use email, calls, texts and QR codes to steal information.
• Recognize the bait, avoid risky actions and report suspected incidents immediately.

Cyber criminals may use social engineering tactics to trick you into giving them access to critical organizational data. With the rise of technology, it is important to identify the tactics used. Phish are always biting, make sure you don’t.

Know the Bait

Social engineering is the use of psychological manipulation to trick individuals into revealing information or performing actions that compromise security.

• Phishing: Fraudulent emails.
  • Example: An email from “email@email.shopmyexchanqe.com” notifying you that you won a random associate drawing for a $1,000 Exchange gift card. The message asks you to confirm your identity by providing your Social Security number. The misspelled domain, unexpected prize and request for sensitive information are all red flags.
• Vishing: A caller claiming to be a representative of a company or trusted individual.
  • Example: You receive a call from someone claiming to be Exchange CISO David Adams, who asks for your Y number and password so they can remotely update your work device. Do not provide credentials or personal information. Verify the request through a trusted, separate Exchange contact method. Neither David Adams nor any other Exchange associate will ask for any personally identifiable information.
• Smishing: Fraudulent text messages.
  • Example: You receive a text message saying a package has been intercepted and directing you to click a link to resolve the issue. Do not click the link. Go directly to the delivery company’s official website or app to check the package’s status.
• Quishing: A fraudulent QR code directing you to a replica of a trusted site.
  • Example: You see a flyer offering a free item from an unfamiliar business and scan its QR code. Instead of accessing a legitimate promotion, it directs you to a malicious website. Verify the source before scanning unexpected QR codes.

I took the bait. Now what?

There is no reason to be embarrassed about reporting a suspected security incident. Cybersecurity is everyone’s responsibility.

• If you have clicked a malicious link or provided information through vishing, phishing, smishing or quishing attacks, report the incident immediately.
• If you received an email that you believe is a phishing attempt, use the “Report Phishing” button in Outlook.
• Report suspicious MFA prompts, unusual login activity, lost or stolen devices, malware warnings and accidental data sharing to SpamReporting@aafes.com.
• Document any useful information, including:
  • Phone number used
  • Individual or organization being impersonated
  • Information the attacker was attempting to obtain
  • Date and time of the incident
  • Actions taken after the event

A Byte of Humor:

What do cybercriminals call a successful phishing attempt?

A reel win.

Reality: Don’t take the bait. Review messages and requests carefully before responding, clicking links, opening attachments or sharing information.

Check out the Exchange Post and @exchangeassoc social channels (Facebook, Instagram and X) every week for Cybersecurity Awareness Month tips and tricks.