Human Risk Reduced Without Manual Effort

In December 2025, Abu Dhabi Police warned residents about fake QR code stickers placed on payment devices and parking meters. In January 2026, the FBI described a state-sponsored group putting QR codes inside emails to slip past filters. Both are QR code phishing, and this post is for security awareness managers in the UAE who need to know what staff will face and how to test for it.

‍

In short: QR code phishing moves the attack from a visible link to an image scanned on a personal phone, where email filters and network controls cannot see it. Test it with realistic QR lures, track who reports them, and coach people at the scan.

‍

How QR Code Phishing Works

QR code phishing, also called quishing, hides a web address inside an image. The victim scans it with a phone, the phone opens the link, and a fake page asks for a card number or a password. Nothing in the image reads as a link, so tools that inspect the text of an email have little to check.

‍

The FBI advisory of January 2026 sets out the enterprise version. It covers campaigns by a North Korean state-sponsored group and says a link hidden in a QR code can evade URL inspection, rewriting and sandboxing. Scanning also moves the victim onto a mobile device outside corporate endpoint and network inspection.

‍

The advisory adds that the fake sign-in pages are tailored to the device, and that stolen session tokens can be replayed to get past multi-factor authentication. For a security team, that makes the scan itself the moment to catch. By the time a password is typed, the attacker may already hold a working session.

‍

QR Phishing Examples Staff Meet

Start with what has been reported in the UAE, because those are the lures your staff are most likely to recognize when they see them again in a test.

‍

Stickers in public places. Abu Dhabi Police warned on 17 December 2025 that scammers place stickers that look like official payment codes on payment devices, parking meters and dashboards. Scanning one opens a fraudulent website that asks for card details or personal data.

‍

Codes on walls. In October 2025, Dubai Municipality warned residents that every QR code they scan could be fraudulent and told them not to scan codes on walls or in public places out of curiosity.

‍

Codes that arrive with a story. The US Federal Trade Commission has described unexpected packages with a note telling the recipient to scan a QR code to find out who sent the gift. The scan can lead to a phishing site or a malware download. A parcel at reception or a printed notice outside a meeting room can carry the same trick into an office.

‍

Codes in email. The FBI advisory describes QR codes sent as attachments or embedded images, from spoofed senders such as an embassy employee, including a fake conference invitation sent to a strategic advisory firm.

‍

Knowing these four patterns is a start, but recognizing them on a busy morning is a different skill, and research shows how wide that gap is.

‍

Why Employees Miss Quishing

A 2025 study at the USENIX Security Symposium tested 1,876 online participants across three experiments that simulated online shopping and payments. The authors come from Ruhr University Bochum, Leibniz University Hannover and Maastricht University.

‍

In the payment experiment, 54% of participants whose email showed fraudulent bank details as text used them, while 87% of those who got the same request as a QR code did. Only 13% recognized the fraudulent QR payment request, against 46% with the typed details.

‍

‍

In the shopping experiment, 43% of participants used a phishing coupon from an email link and 50% used it from a QR code. Among participants who explained their choice, only 2 of 58 in the QR group said they recognized the phishing attempt, compared with 26 of 71 in the link group. Participants who did not believe a QR code could carry malicious content were also less likely to spot the forgery.

‍

For a program built on annual, generic reminders, that is a hard result. A rule such as "check the link before you click" gives a person nothing to check when the link is an image. Practice with the actual format, per person and repeated, is what builds the habit.

‍

QR Code Phishing Awareness Through Simulation

A QR code simulation puts a realistic code in front of an employee through the channel an attacker would use, then records whether they scan, whether they enter anything and whether they report it. Whitebait runs QR code and credential harvesting scenarios in Arabic and English and tracks reporting rate next to click rate, which gives you the number that shows awareness growing rather than only exposure.

‍

Build the lure from the examples above. A payment or parking code suits staff who handle car park and visitor access, a parcel notice suits reception and facilities, and a document or sign-in request suits finance teams and executive assistants. Write each one in the working language of the group that will receive it.

‍

Brand and legal. Use your own company name or an invented brand, not a real bank, ministry or police authority. Impersonating a public body in a test can alarm staff and the public. A code that is printed and placed in a building should be agreed with HR, facilities and legal first, and the landing page should record that credentials were entered, never the credentials themselves.

‍

Reporting route. Decide before launch where a suspicious code is reported, and keep it to one step from the phone or the desk. Clear reporting procedures for suspicious QR codes are among the FBI's recommended mitigations. For teams working in Microsoft Teams, the Fraus Teams App gives staff one-tap phish reporting inside Microsoft Teams.

‍

Coaching at the scan. When someone scans and enters details, Zero-Touch Training responds at once with training matched to the behavior, delivered inside Microsoft Teams, so the lesson arrives while the lure is still fresh.

‍

Frequency. Treat QR scenarios as one lure type in a continuous program, not a yearly event. Let each person's results set the pace: someone who scans and enters details sees another QR lure sooner than someone who reported the first one. Our guide to phishing simulation in the UAE covers how to set that up.

‍

Run Your First QR Test

Go back to the car park sticker. A first test that mirrors it can be small and still tell you where your people stand.

‍

• Pick one role group, such as reception and facilities, or finance.
• Choose one lure from the examples above and write it in the group's working language.
• Agree the sign-off with HR, facilities and legal, and name the reporting route.
• Launch, then read scan rate, credential entry, reporting rate and time to report separately.
• Coach everyone who scanned, and send a harder lure to the people who reported the first.

‍

That gives you a baseline for each role, and a second round shows whether the coaching changed what people do with the next code they meet.

‍

Frequently Asked Questions

How often should we run QR code phishing simulations?

‍

Often enough that QR lures are a regular scenario among your others, not a yearly event. Set the pace by risk. People who scan and enter details should see the next QR lure sooner, and people who report it can move on to a harder one. Track reporting rate and time to report alongside the scan rate.

‍

What should the reporting route be when someone scans a QR lure?

‍

Use the same single route as for email phishing, reachable from the desk and the phone. Anyone who scanned a real code and entered credentials should also change the password and tell the security team, so active sessions can be ended. The FBI recommends clear reporting procedures for suspicious QR codes.

‍

What are the legal and brand considerations for QR simulations?

‍

Use your own brand or an invented one rather than a real bank, ministry or police authority. Agree the scenario with HR and legal, and with facilities if a code will be printed and displayed. Store only the fact that credentials were entered, tell employees the program exists, and write the rules into your program charter.

In February 2024, Hong Kong police described a finance employee who sent about US$25.6 million after a video call in which everyone he saw was fake, and that call was what convinced him the request was real. That is the gap deepfake awareness training has to close, and this guide is for CISOs and security awareness managers who need staff to verify voice and video requests from executives.

‍

In short: Deepfake awareness training works when staff learn to treat a voice or face as a claim, never as proof, and to confirm any request for money, access or codes through a channel they choose. Back it with role-specific practice and a written verification process.

‍

Why Deepfake Voice Scams Reach Staff

Voice and video used to be how people settled doubt. Now they are what attackers copy. The FBI warned in May 2025 that criminals use AI-generated audio to impersonate well-known public figures or personal relations, and that a cloned voice can sound nearly identical to the real person. See the FBI public service announcement for the full guidance.

‍

The UAE Cyber Security Council raised the same concern in November 2025. It said the technology can replicate real people's voices and appearances with high accuracy, and it called public awareness the first line of defense against digital misinformation, as The National reported.

‍

The wider fraud picture explains why this reaches the training budget. Reported losses to the FBI's Internet Crime Complaint Center have risen every year, from about $4.2 billion in 2020 to $6.9 billion in 2021, $10.3 billion in 2022, $12.5 billion in 2023, $16.6 billion in 2024 and $20.9 billion in 2025.

‍

‍

Those yearly totals cover all internet crime, so deepfakes are one part of the rise. The IC3's 2025 report also counts 22,364 AI-related complaints with $893 million in losses, and the FBI notes the AI figures may be understated.

‍

What Deepfake Awareness Training Should Teach

Return to the Hong Kong case. The employee first suspected phishing, because the message appeared to come from the company's UK-based CFO and asked for a confidential transaction. The video call removed that doubt, and he found out only when he later contacted head office, as CNN reported. Staff need to learn that a call cannot do that job, because faces and voices are exactly what attackers now reproduce.

‍

That makes the lesson about the request, not about spotting glitches. Hunting for visual flaws gives people a check that can fail without warning. Teach them the shape of the request instead:

‍

• Urgency or secrecy attached to a payment, a credential or a one-time code
• A request that skips the usual approval path
• A sudden move to a new channel or a personal number
• A senior person who cannot be reached to confirm

‍

Then teach one response, the same every time. Stop, leave the channel and confirm through a number or system you already trust. The FBI's advice follows this pattern: find the number yourself and call, never share a two-factor code, and check money requests through a known contact method.

‍

Executive Impersonation Training in Practice

Executive impersonation training lands better when it matches the job. An accounts payable clerk meets a voice note from the CFO asking for an urgent transfer before the day ends. A service desk agent takes a call from someone who sounds like a director and wants a new MFA device registered. Each person needs the same habit, practiced on their own scenario.

‍

This is where Codex fits. It offers role-based learning paths, deepfake awareness lessons and contextual lessons built on real-world scenarios, in Arabic and English. Its agentic AI recommends or assigns short lessons from each person's training gaps, which suits a topic that changes faster than an annual course. In Odin, role criticality weighting means the people who can move money or reset access are not scored like everyone else.

‍

Add a drill your own team runs by hand. Call a finance or service desk employee from an unfamiliar number, use an executive's name, and make a request that should trigger a call-back. Agree with the executive beforehand, and write down what counts as a pass.

‍

Deepfake Fraud Prevention Needs a Process

A trained employee still faces a senior voice saying it is urgent. Deepfake fraud prevention holds up when the process gives that employee permission to say no. Four controls do most of the work:

‍

• A call-back to a number already on file for any payment, bank-detail or access request made by voice or video
• A second approver above a set payment value
• A rule that nobody gives a one-time code by phone, chat or voice note
• A simple way to report a suspected deepfake call straight away

‍

Executives need to know the rule too. If the CFO has told the team that a call-back is always expected, the clerk who calls back is following policy rather than doubting the boss.

‍

Many of these controls already exist for email fraud. The business email compromise training for finance teams covers the payment side, and a deepfake request is the same attack with a familiar voice.

‍

Measure What Staff Do After the Call

Completion rates show who watched a lesson, not who will call back. Track the share of drills where staff verified before acting, how long it took them to report, how many reports of genuinely doubtful calls arrive, and whether the same people or roles repeat the mistake.

‍

When a person shows a security risk, Zero-Touch Training responds at once with training matched to that behavior, delivered inside Microsoft Teams. Training type, frequency and intensity adapt as the person's risk profile changes, so the response arrives when the risk shows up rather than at the next annual course.

‍

Start With One Role

Go back to the Hong Kong employee. The practical next step is to pick the role that can move money fastest, write the call-back rule that role will follow, and run one drill within a month. Then extend the same pattern to the service desk, executive assistants and the executives themselves.

‍

Frequently Asked Questions

What is deepfake awareness training?

‍

It teaches employees that a voice or video of a senior person is not proof of identity, and gives them a fixed way to verify requests for money, access or codes. Good programs use role-based scenarios, short repeated lessons and practice drills rather than a single annual session.

‍

Can employees tell a deepfake voice from a real one?

‍

Not reliably. The FBI notes that AI voice cloning can sound nearly identical to a real contact. That is why training focuses on verification through a trusted channel and on the pattern of the request, instead of asking people to judge how the voice sounds.

‍

How often should deepfake training run?

‍

Short lessons spread through the year work better than one session, because the scenarios change. Add a drill for high-risk roles and a lesson triggered by risky behavior. Frequency should follow each person's role and risk, with finance and service desk staff getting more practice.

‍

Which roles need it first?

‍

Start with the roles that can act on a request alone: accounts payable, treasury, service desk and IT administrators. Executive assistants and the executives being impersonated come next, since the call-back rule only works when senior staff support it and expect to be called back.

On 8 October 2026, Abu Dhabi Police warned businesses about fake supplier emails that ask finance teams to change bank details and send payments to new accounts. Police say the fraud is often discovered only after the transfer is complete. This invoice fraud prevention UAE guide is for finance controllers and CISOs, and it covers the controls and staff habits that apply in every sector.

‍

In short: Treat every bank-detail change as unverified until someone calls a number already on file, require a second approver, authenticate your email domain, and rehearse the change request with the people who receive it.

‍

Invoice Fraud Prevention UAE Starts at the Payee

The scam needs no malware. A criminal takes over or imitates a supplier mailbox, reads the thread about an open invoice, and sends a short note saying the bank account has changed. The accounts payable clerk sees a familiar name, a familiar amount and a plausible reason, so the request looks like routine admin.

‍

The scale is visible in US figures. The FBI's Internet Crime Complaint Center recorded 24,768 business email compromise complaints in 2025, with reported losses of about $3.05 billion out of $20.88 billion across all internet crime. That makes this one scam type about 14.6% of everything reported, in the 2025 IC3 annual report.

‍

‍

Abu Dhabi Police describe the same pattern locally, and the warning signs they list are ordinary ones: urgency, a sender domain with a small spelling difference, and an insistence on email over a phone call. Because the signals are ordinary, prevention has to sit in the payment process and in habits staff have practiced, not in instinct alone.

‍

A Bank-Detail Change Procedure, Step by Step

Abu Dhabi Police's guidance, also reported by Emirates 24|7, tells finance teams to verify bank-detail requests through official channels. What decides whether that works is where the phone number comes from, so write the procedure for the vendor master change itself:

‍

1. Log the request on receipt: who received it, when, by which channel and which account details it asks for. Change nothing yet.
2. Take the verification number from the vendor master, created at onboarding or from the signed contract, never from the email, its signature or an attached letter.
3. Call and ask the contact to read back the new account name and number. Record who called, which number, when and who answered.
4. If the known contact cannot be reached, try a second contact on the contract or the supplier's account manager. Leave the existing details in place until someone answers.
5. Have a second authorized employee, who did not take the call, review the log and approve.
6. Hold the first payment to the changed account until the approver has checked that the account holder name matches the supplier's legal name on the contract.

‍

A change request is also a signal. Abu Dhabi Police list urgency, a sender domain with a small spelling difference, an insistence on email over a phone call, and a payment account in a different country from the supplier's usual location as warning signs. Treat each one as a reason to hold the request until a second approver has seen it.

‍

The log is what makes the procedure auditable. Months later, a controller can pull any changed account and see the call, the number and both approvers, which tells you far more than a policy that says verification happened.

‍

Prevention Points by Sector

Bank details change fraud works anywhere suppliers are paid by transfer. Construction invoice fraud UAE cases get the attention, and we cover that chain of developers, contractors and subcontractors in Invoice Fraud in UAE Construction. What differs is who holds the supplier relationship, who can ask for a change and where requests arrive, so adjust these typical set-ups to yours.

‍

Healthcare. In a typical hospital group, procurement owns the supplier relationship and finance runs the payment. Make procurement place the call-back, because it holds the contacts, and keep approval with finance so two functions see every change.

‍

Retail and e-commerce. A payables desk with many logistics and service suppliers sees a steady flow of invoices, so a change request can look like part of the flow. Accept account changes only through one form or ticket, never inside an invoice email, which gives clerks a clear reason to refuse an emailed request.

‍

Higher education. Departments often deal directly with contractors and may forward requests to central payables. Make the central team the only intake point for payee changes, and tell departments that a request passed along by email is not a verified change.

‍

Groups with shared finance teams. One team often pays several entities. Verify and log each change per entity, so a call made for one company is never reused as proof for another.

‍

Who Owns What: Finance and Security

A procedure without owners gets skipped. The controller owns the steps above: who may edit the vendor master, the approval limits, the call log and the hold on first payments. The CISO owns the mailbox side: email authentication with DMARC, DKIM and SPF, and a route for staff to report lookalike domains and odd requests.

‍

Give the two roles a standing exchange. Security sends finance the supplier-related reports it receives, finance sends security the list of bank-detail changes made, and once a quarter both sample changed accounts to confirm each has a call record and a second approver.

‍

The approval step can be automated without removing the person. In Agentic Automation Rules, higher-stakes actions such as a finance approval hold always wait for analyst approval, so the hold is never applied without a person's decision.

‍

Rehearse the Request Before It Arrives

Controls fail at the moment of pressure. The day before a payment run, a supplier writes that the account has changed and the money is due today. A clerk with a written rule, who knows that calling back is expected and not rude, makes the call. A clerk who was only told to be careful often pays.

‍

Make the call-back normal. Say in training and in the procedure that verification is part of the job and that no supplier will be offended by it.

‍

Report what looks odd. A lookalike domain or an unusual urgency is worth a message to the security team, even when the clerk did not act on it. Our guide to business email compromise training for finance teams covers what to teach.

‍

Then test the procedure with the people who run it. Whitebait runs phishing simulation for UAE and GCC organizations, with Arabic and English templates, and tracks reporting rate next to click rate. Send a supplier bank-detail change scenario first to the staff who can edit the vendor master. A reporting rate that rises while the click rate falls tells you the habit is forming.

‍

When someone does act on a doubtful request, the lesson lands best straight away. Zero-Touch Training responds when a person shows a security risk, with training matched to the behavior, delivered inside Microsoft Teams in the flow of work.

‍

Start With One Page

Return to the clerk holding a new account number the day before the payment run. With a log, a verified number and a second approver in place, the request costs a few minutes and the real supplier gets paid. Without them, the transfer can leave before anyone doubts it.

‍

This week, write the six steps on one page, name who places the call in each team, and share it with everyone who can edit a supplier record.

‍

Frequently Asked Questions

What is bank details change fraud?

‍

A criminal impersonates a supplier, or uses a compromised supplier mailbox, and emails a request to pay future invoices into a new account. Abu Dhabi Police warn that it is often discovered only after the transfer is complete, so the check has to happen before the payment leaves.

‍

What if we cannot reach the supplier's known contact?

‍

Leave the existing bank details in place and try a second contact on the contract or the supplier's account manager. Never use a number from the request itself. If the payment is due, tell the approver and record the delay, because a late payment can be explained to a supplier and a payment to the wrong account may not be recoverable.

‍

Who owns invoice fraud prevention, finance or security?

‍

Both. The controller owns the procedure, the approval limits and the call log. The CISO owns mailbox security and the route for staff to report suspicious requests. Reviewing a sample of changed accounts together each quarter keeps either side from assuming the other has checked.

‍

Does the same procedure fit every sector?

‍

The steps stay the same. What changes is who places the call and where requests enter: procurement in a hospital group, one form or ticket in retail, central payables in a university. Decide those two points for your own organization, then apply the six steps without exceptions.