MATTHIJSSEN AWARE · CLIENT CASE STUDY

Anatomy of a Recognized
Phishing Attempt

How a QR-code parking scam was recognized, reported, and contained in under ten minutes, because of an awareness email sent twelve days earlier.

MATTHIJSSEN BUSINESS SYSTEMS

Managed IT & Security Services · info@mattnj.com

ILLUSTRATIVE SCENARIO

This is an illustrative scenario, not a report of an actual incident. It is built to show how Matthijssen Aware is designed to work from start to finish, in the same format and level of detail as a real case study. Once real client results exist, this is the template a real case study would follow.

Summary

A staff member in accounts payable received an email claiming to be from a city parking authority. It warned of an unpaid citation and asked them to scan a QR code to pay before a 72-hour deadline. Instead of scanning it, they recognized the pattern from an awareness email Matthijssen had sent twelve days earlier, covering exactly this tactic, and reported the message to Matthijssen without scanning the code.

Matthijssen confirmed it was a phishing attempt, checked whether anyone else had received it, and closed the loop with the employee, all in under ten minutes.

The Scenario

The twelve-day gap between the awareness email and the real attempt is the point being illustrated. The content is not reference material someone would look up in the moment. It creates the half-remembered recognition that makes scanning the code feel wrong before any conscious analysis happens.

What the Awareness Email Covered

The email sent on 27 March recreated the scam as it would actually appear: an email citing a citation number and a short deadline, with a scannable-looking QR code in place of a link. It then walked through three numbered red flags:

▸ The QR code itself. A payment method that only opens by camera, with no link ever shown to inspect or hover over.

▸ The sender. Real citations typically come from a city or county’s own .gov channel, not a generic third-party notice service.

▸ The deadline. A 72-hour window is designed to force scanning before thinking, where a real citation allows weeks.

Why It Worked

This scenario shows why the approach works and why it was not a lucky guess by one employee. QR-code scams are exactly the tactic that can slip past many automated controls. The QR code is an image, not a text link, so there may be nothing for a link-scanning filter to read or flag. No password was entered, so multi-factor authentication never came into play. The scam never got that far.

The only control that could have caught it at that moment was a person who recognized the shape of the attack before acting. That is the premise behind Matthijssen Aware.

The Response

A reported attempt, whether the code was scanned or not, triggers the same short checklist every time:

▸ Acknowledge the report. The employee is thanked directly and told exactly what they got right, since the goal is to reinforce reporting, not just note it silently.

▸ Check for wider reach. Matthijssen checks whether the same message reached other mailboxes on file.

▸ Feed it back into the content. If the pattern is new or notably different from what has already been covered, a generalized version can inform future awareness content, with names and identifying details removed. A real attempt becomes input for future education instead of the end of the story.

What This Illustrates About the Service

A single recognized attempt is an awareness program working as intended, not a security product blocking something. The awareness email did not detect this scam. The employee did, using a pattern they had been shown less than two weeks earlier. That is the mechanism the service is built around: short, specific, realistic examples that create recognition, not just awareness in the abstract.

That is also why reporting matters. When a real attempt like this one is confirmed, Matthijssen may, when appropriate, use a generalized and sanitized version of the tactic in future awareness content, so one close call can help everyone else before a second person receives the same message. Client names, employee information, and other identifying details are never included.

About This Case Study

Matthijssen Aware is Matthijssen Business Systems’ ongoing cybersecurity-awareness service, delivered as email updates, short videos, and social media content built from current scam research. This document is an illustrative scenario built to show how the service is intended to work, in the same format a real case study would use. It should not be read as a report of a specific incident or as a guaranteed outcome. As with any awareness program, results depend on engagement, and no program can guarantee that every attempt will be recognized.