Email gives a request room to look legitimate
Email can combine a familiar display name, convincing business language, a document and a deadline. Scenarios should make the expected safe response clear: verify the sender or request, inspect the destination and use the reporting process when uncertain.
Credential and attachment scenarios need their own measurement definitions. Opening a message, requesting a link and submitting information are different events. Avoid treating them as interchangeable.
QR codes move the decision to a new surface
Quishing uses a QR code to send someone toward a destination. The important learning objective is what happens after scanning: inspect the destination and consider whether a login or payment request fits the context.
A poster, document or message may provide the authority cue. The code’s placement and promise are part of the scenario, not just the URL behind it.
SMS and messaging compress the context
Short messages often rely on urgency, a familiar-looking name or a conversation already in progress. Smishing and WhatsApp-style scenarios can test whether someone pauses before following a link, sharing information or switching channels.
Use examples relevant to the role and local communication habits. Confirm which channels and delivery methods a platform actually supports rather than assuming a template name implies operational support.
Voice adds social pressure in real time
Vishing can create a sense of authority and urgency through conversation. A useful learning objective is a practiced way to pause, decline disclosure and independently call back using a known number.
Any simulation needs agreed boundaries and a clear purpose. Evaluate the real delivery model, oversight and measurement before including voice in a program.
Keep the objective stable across channels
If the risk is an unverified payment change, test independent verification across relevant contexts. This produces a coherent learning journey rather than a collection of unrelated campaigns.
Choose channels because they reflect real exposure. Track coverage and behavior, and use findings to improve both training and the business process.