Callback phishing: the scam email that asks you to call

Callback phishing - sometimes called telephone-oriented attack delivery - is an email that contains no dangerous link and no attachment. It contains a phone number. The message is built to make the reader call, and the attack happens on the call.

The usual pretext is a charge the reader does not recognise: a renewal of antivirus software, a subscription, a large online order. The natural reaction - “I didn't buy that, I'll call and cancel” - is exactly what the attacker wants.

A composite example. The company name is fictional.

It often arrives as a plain-text email or a PDF that looks like a receipt, from a free webmail address. There is nothing to click, so nothing for a link scanner to check.

On a work computer, a remote-access session gives the attacker the same reach as the employee - their mailbox, shared drives, saved browser passwords. That is why this scam matters to businesses, not just individuals.

Shared inboxes - accounts@, office@, info@ - see more of these than personal mailboxes, because whoever reads them is used to handling invoices and receipts they did not personally order.

• No link and no attachment, or only a harmless-looking PDF receipt.
• Sent from free webmail accounts that rotate constantly and have no bad history.
• Wording is ordinary transactional mail - the same words a real receipt uses.
• The dangerous part, the phone number, is something email filters were never built to evaluate.

What does give it away is the combination: a large unexpected charge, a well-known product name, an unrelated sending address, and a phone number as the only way to respond. Zoes names this pattern Callback phishing - one of its attack categories - and files it out of the inbox when the verdict is Dangerous or Suspicious.

• An invoice or renewal for something nobody in the company bought.
• The sender address does not belong to the company named in the email.
• A phone number is the only way offered to cancel or dispute.
• Urgency: refund only "within 24 hours".
• Order numbers, amounts and device counts designed to look like a real receipt.

The fastest way to spot the fake is to know what the real thing looks like. Legitimate software and retail billing follows a few habits that callback scams cannot copy without giving themselves away:

The refund row is the clearest. No legitimate company needs control of your computer to refund a card payment, and none will ever ask you to pay money back because it refunded too much.

A rule for staff

Never call a number from an unexpected invoice. To check a charge, log in to the vendor directly, or look at the company card statement, or ask whoever manages purchasing.

A rule for remote access

Nobody installs remote-support software at the request of a caller. If your IT provider uses a remote tool, write down which one, so anything else is obviously wrong.

A message to send your team

Technical controls

• Remove local administrator rights from everyday accounts, so installing software needs approval.
• If you manage devices, block unapproved remote-access tools.
• Turn on multi-factor authentication, so passwords stolen during a session are less useful.

1. 1End any remote session and disconnect the computer from the network.
2. 2From a different device, change the passwords for email, banking and anything typed during the call.
3. 3Have IT check the machine for remote-access tools or other software installed during the call.
4. 4If money or card details were shared, call the bank's fraud line straight away.
5. 5Report it - in the US to the FTC at ReportFraud.ftc.gov and, for business losses, to ic3.gov.