What is callback phishing? How scam emails get you to ring the attacker

Category hub: Social engineering and human risk

In one sentence: Callback phishing is a scam email with no link, only a phone number, so that you ring the criminals and talk yourself into giving them access or money.

What it is

Most phishing asks you to click. Callback phishing asks you to call. The email warns about a charge, subscription or security alert and tells you to ring a number to dispute it. When you call, a person walks you through the next steps.

MITRE ATT&CK describes the pattern within phishing: victims may be told to call a phone number, where they are directed to visit a malicious website, download malware or install remote management tools. Security vendors call it telephone-oriented attack delivery, or TOAD.

How it works

The lure. An email or text says an invoice, renewal or fraud alert needs urgent attention. It usually has no link or attachment.
The call. You ring the number. The attacker plays support staff, a bank or a software firm.
The pressure. They keep you on the phone and talk you through “cancelling” the charge.
The access. They ask you to install remote support software, read out a code or log in to a fake page.
The pay-off. Stolen logins, a payment or a foothold for later data theft or ransomware.

With nothing to scan, email filters have little to catch. The NCSC warns that over-relying on users spotting phishing wastes effort, and that defences should limit what happens when something gets through.

Who it affects and how badly

Sole trader to 10 staff. A fake software renewal or courier charge can drain a business account or put a remote tool on your only PC.
10 to 250 staff. Accounts staff are expected to deal with invoices, so they are targeted. Accountancy, legal, recruitment and estate agency teams are typical victims, as are schools, charities and councils.
250 plus and regulated firms. Tailored stories can aim at help desks and finance. A successful call can start a chain that ends in a reportable breach.

Real examples

No named victim is included. The sources we could confirm in full were MITRE ATT&CK’s description of the technique and the NCSC’s phishing guidance. Security vendors report that groups use callback phishing to start ransomware or data theft intrusions, and the FBI has issued notices on related phone-led campaigns, but we did not open those primary documents. Flagged for review before publication.

How to detect it

Emails that urge you to call a number and contain no link or attachment.
A sender that claims one company with a mail domain that does not match.
Invoices or renewals for products you do not use.
A caller who pushes you to install software or read out a code.
Remote support tools starting on a PC without a ticket.

How to fix or prevent it

Teach one rule: never call a number from an unexpected email. Find the supplier’s number on a past invoice or its own website.
Never install software or read out codes at a caller’s request.
Route invoice queries through accounts, which checks against a purchase order.
Block or remove remote support tools you do not use.
Configure SPF, DKIM and DMARC, and add an external sender banner.
Give staff a one-click way to report suspicious email and thank them, as the NCSC advises.
Use phishing-resistant MFA so a stolen password is not enough.
Include callback lures in phishing simulations.

Related terms

FAQ

What is TOAD?
Telephone-oriented attack delivery, another name for callback phishing.

Why does callback phishing get past email filters?
The email has no link or attachment to scan. The harmful step happens on the phone.

What does MITRE say about it?
Victims may be told to call a number where they are directed to a malicious site, malware or remote management tools.

Sources

How Wolfcore helps

Phishy runs realistic phishing simulations against your own staff and shows you who clicked, so you can train the people attackers target. See Phishy phishing simulation.