Understanding and Avoiding Vishing, QR Code Scams, and Social Media Fraud

Quick answer: Vishing (voice phishing), quishing (QR code phishing), and social media scams all use a trusted-looking channel — a phone call, a scannable code, or a familiar platform — to pressure you into sending money or sharing personal information. The same core defense works across all three: never act on urgency alone, verify independently through a channel you already trust, and never let someone else choose how you contact them back.

Phishing doesn’t only arrive by email or text anymore. Scammers now call you directly, hide malicious links inside QR codes in public places, and increasingly reach you through the social media platforms you check every day. In 2025, Americans reported losing $3.5 billion to impersonation scams alone — nearly triple what was reported five years earlier — and that’s before counting the billions more lost to scams that started on social media. Here’s how each of these tactics works, real examples of each, and what to do if one catches you.

A Real Example: Scammers Impersonating the FTC Itself

In June 2026, the FTC issued a consumer alert about scammers calling and texting people while posing as FTC employees — sending fake photos of employee badges and inventing bogus “verification” steps to convince targets they were speaking to a real government official. The pitch: the “agent” could help recover money the person had already lost to an earlier scam, but first they needed to move funds or share banking details to “secure” the refund. Some callers even spoofed the FTC’s actual phone number and used real employees’ names.

The FTC’s own guidance is direct: the agency will never contact you by phone or text to ask you to move money, will never send a badge photo as identification, and will never demand payment to release recovered funds. If someone claiming to be from any government agency asks you to act urgently and move money, that request itself is the scam, regardless of how convincing the caller sounds or what they can supposedly prove.

What Is Vishing?

Vishing (voice phishing) is a scam carried out over the phone. Attackers pose as your bank, a government agency, tech support, or even a family member in distress — and use the immediacy of a live phone call to pressure you before you have time to think it through.

Common signs of vishing:

The caller demands immediate action (“Your account will be frozen unless you act now”)
Caller ID looks spoofed, mismatched, or is a number you don’t recognize claiming to represent an organization you know
The caller asks for sensitive information: Social Security numbers, card details, login credentials, or one-time verification codes
You’re told to move money “to protect it” or transfer it to a “safe account”

How to verify a call before trusting it:

Hang up — don’t stay on the line to “confirm” anything.
Call the organization back using a number you already know is real (the back of your card, a past statement, or the official website), not a number the caller gave you.
Never share a one-time passcode over the phone. No legitimate company or agency will ever ask you to read one back to them.

What Is Quishing (QR Code Scams)?

Quishing is phishing delivered through a QR code instead of a link. Because a QR code hides its destination until you scan it, it removes the one warning sign — a visible suspicious URL — that people are usually taught to look for.

A Real Example: Fake QR Codes on Parking Meters

Scammers have placed fraudulent QR code stickers directly over legitimate ones on parking meters in cities across the country. In one documented case, a driver in San Clemente, California scanned what looked like an official parking payment code, entered his card information — and within minutes, his card issuer called to flag unauthorized charges. A similar scheme was later found on roughly 150 parking meters in Redondo Beach, California, where scam codes were glued directly next to the real ParkMobile and PayByPhone labels, sending victims to a lookalike site just one letter off from the real one.

The FTC has confirmed this tactic is active nationwide, warning that fake QR codes also show up in unsolicited texts and emails — often claiming a package couldn’t be delivered or an account needs urgent attention.

How to protect yourself from quishing:

Look closely at the code itself — a sticker placed over another, slightly misaligned or a different material than its surroundings, is a red flag.
Instead of scanning, navigate to the service directly through its official app or by typing the address yourself.
If you do scan a code, check the URL preview before tapping through — watch for misspellings or extra characters in the domain, like “poybyphone” instead of “paybyphone.”
Treat a QR code in an unexpected text or email exactly like a suspicious link: don’t scan it.

Social Media Scams

Social media has become the costliest way scammers reach people. According to the FTC’s 2025 Data Spotlight, nearly 30% of people who reported losing money to a scam said it started on social media, with total reported losses reaching $2.1 billion — an eightfold increase since 2020, and more than people reported losing to text and email scams combined. Facebook accounted for the largest share of losses, with WhatsApp and Instagram a distant second and third.

The most common forms:

Investment scams — the single costliest category, at $1.1 billion in reported 2025 losses. These often start with an ad or post promising to teach you how to invest, or a “friendly advisor” who later invites you into a group full of fabricated testimonials.
Shopping scams — the most frequently reported type. Over 40% of victims said they ordered an item advertised on social media — clothing, electronics, even pets — that never arrived or wasn’t as described.
Romance scams — nearly 60% of reported romance scam losses in 2025 started on social media, where a scammer builds a relationship over weeks or months before inventing a financial crisis or investment opportunity.

How to protect yourself:

Be skeptical of unsolicited investment advice or “opportunities” from accounts you don’t personally know, even in group chats that look established.
Research a seller or company independently before buying from a social media ad, especially for deep discounts on well-known brands.
Never send money, cryptocurrency, or gift cards to someone you’ve only met online, no matter how long you’ve been talking.
Lock down your account privacy settings — scammers often study what you post publicly to make their approach feel personal.

What to Do If You’ve Already Been Targeted

Stop the transaction if it’s still in progress. Contact your bank immediately if you sent money by wire transfer or gift card — these are difficult to reverse, but speed matters.
Change your passwords for any account where you shared login details, and enable two-factor authentication.
Report it. File a report at ReportFraud.ftc.gov (FTC) or ic3.gov (FBI), and report scam social media accounts or ads directly to the platform.
Screenshot everything — the call log, the message, the fake page, or the QR code — before it disappears, in case you need it for a dispute or report.
Watch your accounts closely for several weeks afterward, since stolen information is sometimes used later rather than immediately.