Phishing, Scam Texts, Calls and QR Codes

Phishing, Scam Texts, Calls and QR Codes

Phishing scams use deceptive messages, calls or websites to seek information, money or account access. This guide helps parents, teenagers and other family members check unexpected requests. For example, a delivery text may arrive when you are waiting for a parcel. A message that fits your day can feel credible before you have checked its source.

If you shared payment details, passwords or approvals, open I think I have been scammed: what to do next. Contact your bank immediately if money or banking access is involved. You do not need to identify the exact scam before asking for help.

Table of contents

How phishing scams reach families

How the contact method changes the scam. An email may contain a false invoice, account alert or attachment. A text or messaging app may claim a parcel delivery, family emergency or urgent verification is needed. A call can use a disguised number and pressure you to share a code or authorise a transfer. A QR code can hide a destination until your device shows the link. Use an official app or contact details found independently rather than replying, calling back or relying on the link supplied in the suspicious contact.

Ireland’s NCSC phishing guide covers email, scam texts and fraudulent calls. A text approach is sometimes called smishing, while a voice call may be called vishing. These labels describe the delivery method. The important question is what action the person wants you to take.

A targeted message may use your name, workplace, school or a real purchase. The Council of the EU’s social engineering guidance describes this tailored approach as spear phishing. Correct details do not establish that the sender has permission to request money or access.

Similarly, a familiar person’s account can send a harmful request after someone else gains control of it. Therefore, verify an unusual instruction even when you recognise the contact. The Social Engineering guide explains why trust, fear and expectation can reinforce the story.

Common stories used in phishing scams

  • Delivery or customs: A parcel supposedly needs a small payment or corrected address before delivery.
  • Bank security: A caller says your account is unsafe and asks you to move money, reveal a code or approve access.
  • Refund or unpaid bill: A message offers money back or threatens an immediate service cut.
  • School or club payment: An apparent organiser supplies a new payment link or changed bank details.
  • Account warning: A message threatens suspension unless you sign in through its link.
  • Shared document or invitation: A page asks you to connect an app or approve access before reading something.

Garda scam advice warns about delivery and bank texts, caller number spoofing and requests to install apps. Spoofing means disguising the displayed caller identity. Therefore, a recognised number or sender label does not independently verify the caller.

Also, a small charge can expose payment details. Check the request through an established app or a contact route you obtain separately. Do not let a low amount replace that check.

QR codes and phishing scams

A QR code can be tampered with even when the surrounding sign appears legitimate. Ireland’s National Cyber Security Centre advises checking whether a code has been covered by a sticker, reviewing the destination shown by the phone before opening it and questioning unexpected payment demands. A code behind glass or displayed electronically may be harder to alter physically, but it is not proof that the destination is safe. For parking or ticket payments, use the organisation’s official app or independently established website where possible. If a fraudulent page received card information, contact your bank promptly and report suspected crime to your local Garda station.

A QR code stores information, often a website link. Scanning can bring you to a fake payment or login page. Ireland’s NCSC QR code guide describes codes in messages and stickers placed over genuine codes at locations such as parking payment points.

Example: a fake parking payment QR code. A driver scans a sticker placed over the official QR code on a parking sign. The sticker opens a convincing imitation of the parking operator’s payment page. The driver enters card details and may even see a small charge before discovering it was a fraudulent site. Before paying, check the address or use the operator’s independently verified app or website. If card details were submitted, contact the bank immediately through an official contact route.

  • Check the context. Be cautious of an unexpected code asking for payment or account verification.
  • Look for tampering. A sticker over another code is a reason to pause, although an undamaged code does not prove safety.
  • Inspect the preview address before opening it, where your scanner displays one. A familiar word inside the address is not enough.
  • Use an independent route if unsure. Open the operator’s official app or type its established website yourself.
  • Verify the requested action. Before paying or signing in, check who receives the payment or access.

A QR code can also be part of a legitimate account setup. However, that does not make a code sent by a stranger safe. Do not scan or approve a device linking request merely because someone describes it as identity verification.

Phishing scams can seek codes and permissions

Some pages imitate a login screen and ask for your password. Others ask for a live authentication code or an approval on your phone. Read the approval carefully, including the account, action and amount. Decline a request you did not initiate, then open the provider’s security route independently.

The FBI’s consent phishing alert describes another method: a genuine provider screen asks you to grant access to a malicious app. A correct provider address does not make the requested permission safe. Check the app and what it wants to read or change before authorising it.

If you already approved an unwanted app, changing the password alone may leave that access active. Follow the provider’s instructions to remove the app’s permission and review account activity. Also, check linked devices and sessions through official security settings. The response guide covers these different types of exposure.

Check phishing scams without using their links

  • Pause. Leave the pressured message or call before acting.
  • Open the service yourself. Use the official app or an existing trusted bookmark to check the account, delivery or bill.
  • Contact the organisation independently. Use details from its established website or paperwork, rather than the suspicious message.
  • Check a changed payment instruction with the real person through contact details you already trust.
  • Keep codes and credentials private. Do not send them to someone claiming they need them to cancel a fraud.
  • Ask a trusted person for help if the request is confusing or emotionally difficult.

For example, check a school payment with the school office using its existing contact details. Do not reply to the questionable message to ask whether it is genuine. A reply may simply reach the person making the false claim.

Why appearance does not prove safety

A search advertisement is not proof of official support. The FTC warned in January 2026 that criminals purchase sponsored search placements displaying fraudulent phone numbers. If a message directs you to search for support, do not assume the top advertised listing belongs to your bank or provider. Open the official app, use an existing trusted bookmark, or telephone the number printed on your payment card. Irish families should also follow the National Cyber Security Centre’s guidance on phishing and QR-code deception.

Spelling mistakes, an unusual address or unexpected urgency may raise concern. However, fluent writing and accurate personal details do not prove legitimacy. Avoid teaching a child that one visible clue always settles the question.

US FTC guidance on encrypted connections explains that criminals can encrypt fake websites too. HTTPS protects information in transit to the website. It does not establish that the person running that website is honest. Likewise, a paid advert or professional logo is not an independent check.

If you clicked or responded

First, stop interacting with the page or caller. Opening a link does not by itself establish what access someone obtained. Think about whether you entered information, approved a request, downloaded software or made a payment. Then choose the relevant route in the scam response guide.

  • For money or payment details: Contact the bank or payment provider promptly through its official route.
  • For passwords or codes: Secure the affected account and linked email using a trusted device and official recovery instructions.
  • For permissions or linked devices: Remove unwanted access through the provider’s security process.
  • For a download or remote access: Stop using the device for sensitive activity and seek trusted technical help.
  • Keep safe evidence such as messages, sender details, payment references and a timeline. Avoid reopening harmful files or links.

Report suspected fraud to your local Garda station and use the service’s reporting tools. The NCSC QR guide also gives its official phishing reporting route. However, reporting does not replace urgent bank contact or securing an exposed account.

Spot the pressure in a fictional phishing scam

Fictional example: A parent receives a text saying a parcel needs a small address correction fee today. The link opens a convincing page. After entering card details, the parent receives an approval request showing a larger amount.

  • Claim: A delivery company needs a routine correction.
  • Action: Enter card details and approve a payment.
  • Pressure: Expectation of a parcel and fear of missing delivery.
  • Uncertainty: The parent has not checked the company or the actual approval.
  • Safer check: Decline the unexpected approval, contact the bank if details were entered and check the parcel through the official service.

Afterwards, discuss what made the text seem relevant. Also, practise reading an approval rather than treating every phone prompt as a routine confirmation. Keep the exercise fictional and avoid testing relatives with deceptive messages.

Family phishing checklist

  • Check requests through an independently opened app or trusted contact.
  • Treat unexpected money, code, download and permission requests as a reason to pause.
  • Protect email and other accounts with unique passwords and available extra login protection.
  • Keep software updated and discuss QR codes alongside ordinary links.
  • Make asking for help possible even after someone clicks or pays.

Frequently asked questions

Can phishing scams come from a known number?

Yes. Displayed caller details can mislead, and a familiar account can be compromised. Therefore, check unexpected requests through a separate route you already trust.

Does scanning a code prove my phone is compromised?

No. Consider what happened afterwards, including the page opened, information entered and any approvals or downloads. However, if payment or account details were exposed, act promptly rather than waiting for visible signs.

Does extra login protection stop every phishing scam?

No. It helps protect accounts, but criminals can still seek live approvals, codes or app permissions. Also, some scams involve a payment that the person makes themselves.

Related CODA guides

References

About Children of the Digital Age

Children of the Digital Age provides online safety education and training for families, schools and organisations. Our work connects practical cybersecurity with online behaviour and cyberpsychology. These guides support informed choices and appropriate specialist help.

Send a message

Contact Us about education, training or a parent session. This form is not monitored as an emergency service. Please do not send passwords, banking codes, identity documents or intimate images.

    Last updated: 26 October 2026