Learn how smishing, vishing, and quishing scams work — and the simple steps you can take to stay protected.
Scammers are reaching people in more ways than ever — from text messages and phone calls to QR codes. Understanding how these tactics work can help you recognize warning signs and protect your personal and financial information.
Three common tactics to be aware of include smishing, vishing, and quishing.
Smishing: Scam Text Messages
Smishing, or SMS phishing, uses fraudulent text messages to trick people into sharing personal information, clicking malicious links, or downloading malware. These messages often appear to come from trusted organizations such as financial institutions, delivery services, or online retailers.
Common examples include:
- Fake fraud alerts
- Delivery or package updates
- Account verification requests
- Prize or gift card offers
To stay safe:
- Avoid clicking links in unexpected text messages
- Verify requests through official channels
- Enable two‑factor authentication when available
- Report suspicious texts to 7726 (“SPAM”) and the Federal Trade Commission (FTC)
Vishing: Scam Phone Calls
Vishing, or voice phishing, involves phone calls or voicemails from scammers pretending to represent legitimate organizations. They may claim to be from a financial institution, government agency, or tech support provider and ask for sensitive information.
A few simple habits can help protect you:
- Never share personal information during unsolicited calls
- Hang up and contact the organization directly using a trusted number or visit the organization’s verified website
- Use call‑blocking tools when available
- Consider registering your number on the National Do Not Call Registry
Quishing: Scam QR Codes
Quishing, or QR code phishing, uses malicious QR codes to direct users to fraudulent websites, steal information, or install malware. These codes may appear in emails, text messages, advertisements, or public spaces.
They often claim to help with:
- Package deliveries
- Account verification
- Coupons or promotions
- Charitable donations
Tips when scanning QR codes:
- Avoid scanning codes from unknown or unsolicited sources
- Preview the link before opening it
- Verify websites by typing the address directly into your browser
- Be cautious of pages asking for sensitive information
Even if a website looks legitimate, it’s important to verify it independently before taking action.
The Bottom Line
Scammers are constantly evolving how they reach potential victims, making awareness one of your strongest defenses. Taking a moment to verify unexpected texts, calls, or QR codes can help prevent costly mistakes.
CEFCU will never ask for sensitive information — such as full account numbers or one‑time passcodes — through unsolicited messages or requests.
If something doesn’t seem right, trust your instincts and contact CEFCU at 1.800.542.3328. We’re here to help you identify potential scams and protect your financial well‑being.
