Email, Chat, SMS, and QR Codes: Read the Route

Email, Chat, SMS, and QR Codes: Read the Route

This lesson treats written social engineering as route design. Learners inspect the path from sender claim to reply address, link destination, attachment, sign-in page, or QR code, then leave that route and use a known-good channel.

Read the action route, not the polish

A polished message can still route you into an attacker-controlled decision. Logos, signatures, fluent language, familiar avatars, and a plausible thread improve appearance, while the operational route lives in the reply address, link destination, attachment behavior, sign-in prompt, phone number, or QR code. Read the route before judging the costume.

Trace the next two steps, not only the first click. A message may link to a legitimate file-sharing service that contains a second link to a fake sign-in page. A QR code may open a phone browser where corporate protections and the full address are less visible. A reply may go to a subtly different domain even though the displayed sender looks familiar.

The decisive question is “Who controls the next surface?” If the message supplies both the problem and the only route to solve it, independence is missing. Open the service from a bookmark, known application, or typed address; contact the person from your directory; and locate the document inside the expected workspace. A true request should survive a safer route.

Links, files, and QR codes move the decision

Links, files, and QR codes are transport mechanisms for a decision. A link can move you to credential capture, a file can ask you to enable active content, and a QR code can hide a destination until another device opens it. The object itself may be harmless-looking; the risk lies in what it asks you to authorize next.

Inspect without interacting when your tools and policy permit it. Compare the displayed text with the actual destination, note unexpected domains or redirects, and treat shortened addresses as obscured routes. Do not upload sensitive material to public analysis services unless policy permits it, and do not open a suspicious file merely to satisfy curiosity. Safe handling is part of the decision path.

For example, an “updated benefits” QR code posted near an office entrance may lead to a convincing login page. Instead of scanning, open the benefits portal through the intranet or known app and look for the announcement there. This does not depend on detecting every visual trick; it defeats the supplied route by choosing a destination you already trust.

Leave the message to verify the request

Independent verification starts by leaving the conversation. Do not use the message’s reply button, link, phone number, meeting invite, or attached instructions to confirm the message that supplied them. Choose a route established before the request: a saved bookmark, internal directory, known application, supplier record, or face-to-face conversation.

Verification must cover the action, not merely the person. A colleague may confirm, “Yes, I sent a document,” while an attacker-controlled document still asks for credentials. Ask a complete question: “Did you send this document, does it require a sign-in, and should it be in our approved workspace?” Precise verification exposes mismatches that a vague “Is this you?” may miss.

Channel switching is not automatically independent. Moving from email to a phone number written in the same email leaves control with the sender. Independence comes from a separate source of trust. When no trusted path is available, pause the action and escalate; uncertainty is a valid state, not a command to improvise.

Resources

• CISA Secure Our World Phishing Tip Sheet — A concise public guide that reinforces leaving suspicious links, attachments, and supplied phone numbers and contacting the organization through a known route.
• FTC: How to Recognize and Avoid Phishing Scams — Examples and practical response guidance for suspicious email and text messages, including what to do after responding and how to report.