NewAI Content Creation is now live in Early Access
Turning Point Training Instituteby Training Center
Catalog
Skip to content
0%
Unit III — The Human Attack SurfaceLesson 3 of 6
10 min readBeginner

Where you are: Unit III — The Human Attack Surface · Lesson 3.3 · This topic is new in the 2026 edition of the course. It extends Chapter 7 of Dr. Al-Doori's Cyber Security Essentials from email to the other channels scammers now use.

Dr. Al-Doori's email chapter explains why scammers love cheap, mass communication. Today that same logic applies to text messages, phone calls, QR codes and even fake pop-ups on web pages. This lesson shows you how to recognise each channel, and gives you one rule you must never break: never run a command a web page tells you to copy and paste.

What you'll be able to do

Recognize phishing delivered by text, phone, QR code and fake browser prompts, and never run a command a web page asks you to paste.

  • Recognise smishing, vishing and quishing, and the habit that defeats each.
  • Explain how fake "verify you are human" and "fix it" pages trick people into infecting their own computers.
  • Report a scam text and know what to do if you have already tapped or pasted something.

Smishing: scam texts

Smishing is phishing by SMS or messaging app. Common examples are a parcel that "couldn't be delivered", an unpaid road toll, a traffic fine, a bank alert or a refund. The US Federal Trade Commission (FTC) warned in April 2026 that a text about a traffic violation is probably a scam. Texts are short, arrive on the device you carry everywhere, and are read quickly, which is exactly what scammers want.

The levers from Lesson 3.1 are all here: authority (a bank, a courier, the police), urgency ("pay today or face a penalty") and fear. The habit is the same too:

  • Don't tap links in unexpected texts. Open the organisation's official app, or a bookmark or typed address, and check there.
  • Read the domain if you must look at a link, using the method from Lesson 2.3.
  • Don't reply or call back using details in the text. Those channels belong to the sender.

Vishing: scam calls

Vishing is phishing by voice call or voicemail. The caller may claim to be your bank's fraud team, a delivery company, tech support or a government office. Caller ID can be spoofed (Lesson 3.1), so the name on your screen proves nothing.

Text and voice scams are growing. The anti-phishing group APWG reported that smishing rose by about 40% and vishing by about 20% from the first to the second quarter of 2026. Verizon's 2026 Data Breach Investigations Report found that mobile-centric lures got about 40% higher click rates than email in its simulations.

Often the two channels work together: a text warns of a "suspicious payment" and gives a number to call, where a friendly "agent" talks you into sharing a code or moving money. Apply the rule from Lesson 3.1: hang up and call a number you already trust. Never use the number in the text.

Quishing: QR code traps

Quishing is phishing through a QR code. A QR code is just a web address in picture form, so you can't read the domain until you scan it. The FTC has warned that scammers hide harmful links in QR codes, for example by sticking their own codes over the real ones on parking meters, or by sending codes in emails and texts. APWG notes that QR codes in emails can slip past traditional email filters, because the filters can't easily read the link inside a picture.

Safe habits:

  • Check the physical code. A sticker placed over another code is a warning sign.
  • Read the address your camera previews before opening it, and check the registered domain.
  • For payments, prefer the official app or a typed address, especially when you are asked for card details.
  • Be very wary of a QR code in an unexpected email or text. It is just a link in disguise.

ClickFix: fake "verify" and "fix it" pages

This is the newest trick and one of the most dangerous. You visit a web page, perhaps through a search result, an advert or a link, and it shows something that looks familiar:

  • a "verify you are human" check (a fake CAPTCHA), or
  • an error message offering a quick "fix".

Then come instructions: press a couple of keys to open a command window on your computer, paste in some text (often the page has already copied it for you) and press Enter. What you paste is a command that downloads and runs malicious software. You end up doing the attacker's work yourself.

Microsoft Threat Intelligence describes this technique, called ClickFix, and reports that it targets both Windows and Mac users. The malware it delivers often includes infostealers, programs that steal saved passwords, browser data and more. ENISA, the EU cybersecurity agency, described ClickFix as prevalent in 2025.

Never run a command a web page tells you to copy and paste. No genuine CAPTCHA, website or "human check" will ever ask you to open a command window, the Run box or Terminal and paste something into it. If a page asks, close it.

Reporting and recovering

Report scam texts. In the UK and the US, many mobile networks let you forward a scam text to 7726, then delete it. Your phone's messaging app may also have a "report junk" option. Report scam emails with your email app's reporting button.

If you already tapped, typed or pasted something:

  • Entered a password? Change it straight away on the real site, and anywhere else you used it.
  • Gave card or bank details? Call your bank on the number on your card.
  • Pasted a command? Treat the device as compromised. On a work device, tell your IT team at once. On a personal device, follow the recovery steps in Lesson 6.1, starting with changing important passwords from a different, clean device.

Acting quickly limits the damage. There is no shame in being caught; these tricks are designed by professionals.

Real-World Example

In August 2025, Microsoft Threat Intelligence published an analysis of ClickFix. It describes campaigns in which people were sent to pages showing a fake human-verification check or an error message, with step-by-step instructions to paste and run a command. Victims who followed the instructions installed malware themselves, including infostealers. In February 2026 Microsoft reported infostealers aimed at Macs being delivered through ClickFix lures and fake installers. So "I use a Mac" is no protection against a page that persuades you to run its command.

Why This Matters in 2026

  • Scams have moved to your phone. Texts and calls now out-perform email in click-rate simulations (Verizon 2026), and text and voice phishing are growing quickly (APWG Q2 2026).
  • QR codes hide the address you would normally check, and can slip past email filters.
  • ClickFix turns you into the installer. The attacker needs no attachment and no software flaw, only your paste.
  • The answer is the same habit throughout: don't act inside the message or page. Go to the official app, website or phone number yourself, and never paste commands from a web page.

What Would You Do?

You park in a town-centre car park. The pay machine has a QR code sticker reading "Scan to pay by phone". It opens a payment page asking for your card number. You notice the sticker sits slightly crooked over another printed code. What do you do?

Knowledge Check

A text says you have an unpaid road toll and must pay within 24 hours to avoid a penalty, with a link. What is the best response?

A web page shows a 'verify you are human' box. It tells you to press two keys, paste what it has copied, and press Enter. What should you do?

A caller says he is from your phone company. He says your account has been hacked and asks you to read out the code they just texted you so he can secure it. What should you do?

Answers explained

  • Question 1 — c is right. Going to the official site or app yourself checks the claim safely, and reporting helps stop the scam. a is not right: a small amount is bait; the real target is your card details. b is not right: replying engages with the scammer and checks nothing. d is not right: tapping the link opens the scammer's page, and the page wouldn't truthfully tell you who sent it anyway.
  • Question 2 — a is right. This is ClickFix. No real CAPTCHA asks you to run anything. b is not right: genuine checks only ask you to tick a box or pick pictures, never to paste a command. c is not right: there is no safe partial step; pasting into a command window is already the danger zone. d is not right: https only means the connection is encrypted; criminals use it too.
  • Question 3 — b is right. Contacting the company through a channel you trust breaks the scam. a is not right: the code may be genuine precisely because the criminal triggered it by trying to get into your account. Reading it out hands them access. c is not right: a second code is just as dangerous. d is not right: once the criminal has the code, they may lock you out before you can change anything.
  • The parking sticker (What Would You Do?): don't scan it or enter card details. A sticker placed over another code is a classic quishing sign. Pay at the machine, through the parking operator's official app, or at an address printed on official signage that you type yourself, and tell the car park operator about the sticker.

Key Takeaways

  • Smishing (texts), vishing (calls) and quishing (QR codes) use the same levers as email phishing, on the device you trust most.
  • Don't act inside a message: use the official app, website or a number you already trust.
  • A QR code is a hidden link. Check the physical code and the address it previews.
  • Never run a command a web page tells you to copy and paste (ClickFix).
  • Report scam texts (in the UK and US, forward to 7726) and act fast if you've already tapped or pasted.

Sources

Next
PreviousEmail Threats: Phishing, Spoofing, Attachments and OversharingNextAI-Enabled Scams: Cloned Voices and Deepfakes