Staff Training: Phishing, Smishing and Quishing

Many incidents start with a deceptive message someone opens, a link someone follows or a call someone answers. Training the team with familiar examples is one of the most cost-effective ways to reduce that risk.

• Social engineering targets the person, not only the system.
• Training works best when it is hands-on and uses real, local cases.
• It should be complemented by technical controls and a clear reporting channel.

Four types worth recognising

1. Phishing. Emails imitating a supplier, institution or colleague to obtain passwords or get files opened.
2. Smishing. The same, by text or messaging app, with shortened links or fake delivery or payment notices.
3. Vishing. Calls in which someone poses as technical support, an executive or another entity to ask for data or urgent actions.
4. Quishing. QR codes that lead to fake sites, placed in emails, posters or documents.

How to run training people remember

• Real, local cases. Messages circulating in Chile, in formats and brands people recognise, stick better than generic examples.
• Practice. Show and analyse messages, spot the signs and decide what to do.
• Simple messages. Distrust urgency, verify through another channel, never enter passwords from a link.
• No blame. Someone who reports a mistake promptly helps the organisation; punishing them discourages reporting.
• Record. Keep a record of the session, date, presenter and attendees.

Measures that accompany training

Training does not replace technical controls: multi-factor authentication, email protection, updates and a password manager reduce the damage when someone makes a mistake. A clear reporting procedure also matters, which ties in with incident playbooks.

What to do

• Schedule a hands-on session for the whole team, management included.
• Prepare examples specific to the organisation's activity.
• Define whom and how to report a suspicious message.
• Repeat training regularly and include new joiners.
• After an incident, review what lesson it left.

Frequently asked questions

Is one talk a year enough? It is a start; short, periodic reinforcements work better.

Are phishing simulations advisable? They can help if communicated transparently and used to learn, not to sanction.

Who should attend? Everyone with email or system access, starting with those who handle payments or sensitive data.

When supporting our clients, we run hands-on sessions with real local cases of phishing, smishing, vishing, quishing and malware.

IT Lab supports Chilean organisations in this. Contact us.