Phishing, fake texts, phone calls and QR codes: fraudsters change their methods, not their goal

An email from your bank, a text message about a parcel, a call from the “fraud department” or a QR code to pay an invoice.

Everything looks normal. And that is precisely the problem.

Fraud attempts are becoming increasingly convincing. The obvious spelling mistakes and poorly written messages that once made scams easy to spot are gradually disappearing. Fraudsters are now able to imitate banks, public authorities, suppliers, delivery companies and businesses with increasing professionalism.

103 million fraudulent calls intercepted

The scale of the problem is considerable.

According to figures published by the BIPT in September 2026, Belgian telecom operators intercepted 103 million fraudulent calls in the first half of 2026 alone, before they even reached users.

And fraudsters certainly do not limit themselves to phone calls.

Phishing, smishing, vishing, quishing…

Behind all these terms lies essentially the same objective: to impersonate a trusted party and persuade you to take action.

Phishing uses email: a fake invoice, a message supposedly from the Belgian tax authorities, a fake supplier or a fraudulent login request.

Smishing uses text messages or messaging apps: a parcel waiting for delivery, a fine, a refund or an account that needs to be unblocked.

Vishing takes place over the phone: a fake bank adviser, IT support agent or public authority representative.

Quishing uses a QR code to redirect you to a fake website or payment page.

Be careful with QR codes

A QR code has one particular characteristic: it hides the link to which it redirects you.

A fraudulent QR code can appear in an email, text message, letter or fake invoice. Fraudsters can even place a sticker containing their own QR code over a perfectly legitimate one.

A recent campaign, for example, impersonated the Belgian tax authorities by offering a fake refund and asking recipients to scan a QR code to provide their bank details.

The right reflex is simple: treat a QR code with the same caution as a link received by email or text message.

Even the phone number displayed can be fake

Using a technique known as spoofing, fraudsters can falsify caller identification. A Belgian or apparently familiar phone number may therefore appear on your screen even though the call actually originates elsewhere.

The same applies to websites: a padlock symbol and “https” are no longer sufficient proof that a website is legitimate.

AI is making life easier for fraudsters too

Artificial intelligence is making these attacks even more convincing.

AI can generate perfectly written messages in seconds, in different languages and without the spelling and grammar mistakes that once made phishing attempts easier to identify.

It also makes it easier to personalise messages using information found online or on social media. Today’s technology can even imitate voices and generate highly realistic images and videos.

A well-written, personalised and professionally presented message is therefore not necessarily genuine.

Take 30 seconds before clicking or paying

Three simple questions can already help prevent many scams:

Was I expecting this message?
An unknown invoice, an unexpected parcel or a surprise refund should immediately raise your attention.

Am I being pressured to act urgently?
“Pay immediately”, “your account will be blocked”, “last chance”… Creating a sense of urgency is one of the fraudsters’ favourite techniques.

Can I verify the information another way?
If in doubt, contact your bank, supplier, public authority or accountant directly using contact details you already know, never those provided in the suspicious message.

A change of bank account number on an invoice, for example, should always be independently verified before making the first payment.

Received a suspicious message?

In Belgium, suspicious messages can be forwarded to suspicious@safeonweb.be and then deleted.

If you have disclosed bank details or security codes, contact your bank immediately and, if necessary, Card Stop on 078 170 170. If you have suffered a financial loss, you should also report the incident to the police.

Technology is evolving, and so are the methods used by fraudsters. Yet the best reflex remains remarkably simple:

When faced with an unusual request for payment, identification or personal information, do not act under pressure. Verify the request through another channel.

A few seconds of verification can prevent a scam costing thousands of euros.