Fake Websites, Quishing, and AI Voices: How to Spot Modern Cyber Scams
- Press
Key Findings
Personalized attacks: Messages exploit real-world contexts (such as pending parcel deliveries) and email leaks from the dark web.
The HTTPS myth: Neither a site’s appearance nor the padlock icon (HTTPS) guarantees that a website is official.
Deceptive domains and quishing: Malicious domains containing typos and QR codes (quishing) can easily trick the eye on a smartphone screen.
AI voice cloning: AI needs only a short audio sample to convincingly clone a voice.
Name-to-IBAN matching rule: If your bank warns you that the recipient's name does not match the IBAN, cancel the payment immediately.
Tailored Scams and Exploiting Data Leaks
Instead of generic messages about unexpected inheritances, attackers today rely on personalization. They know precisely how to tailor messages to everyday situations people encounter, such as an expected package delivery. Scammers can purchase email addresses from previous data breaches at shipping companies, and this contextual knowledge dramatically increases the chances that the recipient will view the message as trustworthy.
"Lists of leaked addresses from various services can be bought on the dark web for literally just a few euros," warns Michal Srnec from Aliter Technologies.
Psychological Pressure: When Even Experienced Users Fail
Social engineering relies on creating a sense of urgency and impersonating authority. Demands for an immediate password change under the threat of account suspension are designed to force people to act without verifying the facts. Under stress and pressure, even tech-savvy users make mistakes.
Fake Websites and Domain Tricks
Scammers can copy the graphics and layout of an official website in a matter of seconds, making visual design a poor indicator of authenticity. The key is to examine the exact URL address, as attackers frequently use typosquatting. For example, combining the letters "r" and "n" in a domain name closely resembles the letter "m". Additionally, a security certificate (HTTPS) does not verify the site owner's credibility; it merely ensures encrypted data transmission.
Voice Cloning and Dangerous QR Codes (Quishing)
Based on an audio sample lasting only a few dozen seconds, artificial intelligence can accurately mimic the voice of a relative or boss to request an urgent money transfer. The main risk with quishing is that you cannot see the target URL from the QR code image itself, and address bars are often hidden on smartphones. It is always necessary to expand and check the full address before entering any data.
Payment Verification and Emergency Measures
Under the influence of manipulation, users often hand over verification codes or approve transactions themselves. Before sending money, double-check the recipient and the IBAN. New regulations require banks to notify clients if the name does not match the IBAN. In such cases, stop the payment right away. If you have already shared your details, contact your bank immediately. A swift response allows the bank to block access credentials and prevent further damage to your account.
Summary: Questions & Answers
What is quishing?
It is a scam technique using QR codes that redirect victims to fake websites designed to harvest login credentials or payment details.
Does an HTTPS certificate guarantee a website's safety?
No. The certificate only indicates encrypted data transfer between you and the website, but it does not verify the authenticity or intentions of the website operator.
How can you protect yourself against voice scams?
In a company setting, rely on formal approval workflows and multi-factor authentication (MFA). Within families, setting up a pre-agreed passphrase that is never shared online can help.
What should you do if you enter your details on a scam site?
Contact your bank without delay, report the incident, and request to block your card and restrict access to online banking.
SOURCE: TREND
