Phishing moved off email: QR codes, texts and fake voicemails

An office manager gets a text at 4:47 pm: “Are you at your desk? I need a favor before my flight boards. - Mike.” Mike is the owner’s actual first name. The number is unknown, but the timing is plausible and the tone is right. Twenty minutes later the office manager is at a drugstore reading gift card codes to a stranger over text, convinced she is helping her boss close out a client thank-you before a trip.

Nothing in that attack touched your email system. That is the point.

Why attackers left email

Small businesses have spent a decade hardening email, and it worked. Microsoft 365 filtering has improved, DMARC, SPF and DKIM are closing off domain spoofing, and employees have been trained to hover over links. Email phishing still exists at enormous volume, but its conversion rate keeps dropping.

So attackers moved to channels with no filter in front of them:

• Text messages (smishing). Your phone carrier does almost nothing that resembles enterprise email filtering. A text arrives with full urgency and zero scanning.
• QR codes (quishing). A QR code in an email or on paper is just an image. Filters that inspect links often cannot follow what the code encodes, and the person scans it with a personal phone that sits outside your security stack entirely.
• Callback phishing. An invoice arrives for $487 charged to a subscription you do not remember. There is no link at all, just a phone number to “cancel.” The person who calls is socially engineered by a live human, and there is nothing for a filter to catch because the email contained nothing malicious.
• Fake voicemails. An email with a “voicemail attached” lure, or increasingly an actual call with a cloned voice. Voice cloning tools now need only seconds of sampled audio to produce a passable imitation of a specific person.
• MFA fatigue. The attacker already has a password and simply triggers push prompts over and over, sometimes at 2 am, until the target taps approve to make the phone stop buzzing.

Why these channels work so well

Each channel exploits a specific gap:

• Small screens hide detail. On a phone, the full URL is truncated, the sender’s address collapses to a display name and the visual cues people were trained to check on a desktop simply are not visible.
• Personal devices, personal context. A text feels personal and informal. People apply work-mode skepticism at their desk and drop it on their own phone. Since most 10 to 30 user companies run on employee-owned phones anyway (we wrote about that in our BYOD guide), the attack lands on a device the business does not manage.
• Urgency plus authority. The boss-needs-gift-cards text works because it stacks a plausible authority figure on top of time pressure. The gift card detail matters: codes are cash, instantly transferable and unrecoverable.
• No artifact to inspect. Callback scams and voice calls leave nothing to hover over. The malicious part of the attack happens in conversation.

The FBI’s Internet Crime Complaint Center has tracked losses to phishing and its variants in the billions of dollars annually for years, and the text-and-phone flavors are the growth segment. The dollar losses per incident are small for gift card scams, typically $500 to $3,000, but the same channels deliver payloads that end in payroll diversion and wire fraud, which is where 5-figure and 6-figure losses live. We walked through that escalation in our business email compromise breakdown.

Defenses that actually match these attacks

You cannot filter your way out of channels you do not control. The defenses are partly technical and mostly procedural.

1. Number-matching MFA, not plain push. If you use Microsoft Authenticator, turn on number matching (Microsoft made it default behavior in 2023, verify it is active). The user must type the 2-digit number shown on the login screen, which makes blind-approve impossible and kills MFA fatigue attacks outright.

2. An out-of-band verification habit. One rule, drilled until it is reflex: any request involving money, gift cards, payment changes or credentials gets verified on a different channel than the one it arrived on. A text from the boss gets a phone call to the boss’s known number. An invoice cancellation number gets checked against the vendor’s real website. This single habit defeats nearly every attack in this post.

3. A no-penalty report culture. The office manager in the opening either sends a quick “is this really you?” message to a known channel, or she does not. Whether she does depends on culture. If reporting a weird text earns praise and a false alarm costs nothing, you get early warning. If people fear looking foolish, you find out after the gift cards are drained. Short, frequent training that covers text and phone lures, not just email, builds this reflex. Our take on awareness training a small company will actually complete covers the cadence.

4. Treat QR codes like unknown links. Policy for staff: do not scan QR codes from emails, invoices or unsolicited paper mail with a phone that has access to company email. If a vendor communication pushes you to a QR code, type the vendor’s address manually instead.

5. A known-good contact list for money movement. Finance staff should have verified phone numbers for the owner, the bank and top vendors, stored ahead of time. Verification only works if the correct number is not sourced from the attacker’s own message.

The 30-minute fix this week

If you do nothing else after reading this:

• Turn on number matching for MFA and confirm push approvals without it are disabled
• Tell your team, in writing, that the company will never request gift cards by text and that all payment changes require a voice callback to a known number
• Add one text-message phishing example to your next training touchpoint

Those 3 items cost nothing and remove the highest-probability losses.

Atticus Rowan builds this layered setup for small businesses across Ohio: hardened Microsoft 365 and MFA configuration, awareness training that covers the channels attackers actually use now and the financial-controls procedures that stop the expensive endings. If your defenses were designed for 2019-era email phishing, reach out and we will close the gaps the attackers moved into.