What is callback phishing?
Callback phishing, also known as Telephone-Oriented Attack Delivery (TOAD), is a social engineering attack in which an attacker impersonates a trusted organization and persuades the victim to call a phone number controlled by the attacker. During the call, the attacker attempts to gather sensitive information, manipulate the victim into performing specific actions, or gain access to accounts, systems, or funds.
Callback phishing relies more on psychology and human interaction than on sophisticated technology. Attackers create a sense of urgency by presenting a fabricated problem, such as a suspicious transaction or an impending service disruption, and convincing the recipient that immediate action is required.
The difference between normal phishing and callback phishing
The primary difference between conventional phishing and callback phishing is how the attacker initiates the next stage of the attack.
In conventional phishing, the email usually contains an actionable content such as a malicious link or attachment. The victim is encouraged to click the link, open the attachment, enter credentials into a fraudulent website, or otherwise interact with a malicious payload.
In callback phishing, the email may not contain a malicious link or attachment. Instead, the recipient is given a phone number and encouraged to call it to resolve a supposed issue. The phone call becomes the next stage of the attack, allowing the attacker to use social engineering to obtain information or access.
The absence of a malicious link doesn’t make the message safe. It simply moves the next stage of the attack from the email interface to a human conversation. The key difference is simple: The victim is encouraged to initiate the interaction.
Modes used for callback phishing
Callback phishing isn’t limited to email. Attackers can use multiple communication channels to encourage a victim to make a call.
Email: The callback number is included directly in the email or hidden within an attachment or document that the victim is instructed to open.
Voicemail: The victim receives a voicemail that appears to come from a service provider, financial institution, or other trusted organization and is asked to call back.
One-ring calls: The attacker makes a brief call and disconnects before the recipient answers, leaving a missed call. The curiosity or concern created by the missed call encourages the victim to return the call.
SMS: A text message impersonates a service provider and informs the recipient of an urgent issue, along with a number to call for assistance.
How to protect yourself from a callback phishing attack
Protection against callback phishing requires both technical controls and user awareness.
Watch for brand abuse across channels
Attackers impersonate the same organization through email, SMS, voicemail, websites, and telephone calls. Look beyond individual messages and look for patterns of brand impersonation across multiple communication channels.
Look for legitimacy across the attack assets
Don’t evaluate an email in isolation. Examine the sender, domain, phone number, message content, branding, websites, attachments, and any other assets involved in the interaction. A convincing logo or familiar brand name alone doesn’t establish legitimacy.
Triage using real-time incident feedback
Information from users who report suspicious calls or messages can help security teams identify emerging campaigns. If several users report similar messages, phone numbers, subjects, or impersonated brands, the organization can use that information to investigate and respond more quickly.
Unusual email content
Pay attention to messages that strongly encourage the recipient to take action but contain no conventional link or attachment. The absence of a link shouldn’t automatically make an email trustworthy.
Metadata anomalies
Attackers can manipulate email headers and sender information to make a message appear to originate from a trusted organization. Analyze the email headers to verify sender details and authentication status, and look for indicators such as:
- Poor or unexpected sender reputation.
- Unusual sending patterns or timestamps.
- Inconsistent sender information.
- Domains that don’t align with the claimed organization.
Embedded phone numbers
Phone numbers deserve additional scrutiny when they appear alongside urgent language, unexpected billing claims, account warnings, or vague references to security issues.
A phone number by itself isn’t evidence of a phishing attack. The concern is when it’s combined with urgency, impersonation, and an unsolicited request to call.
When you receive an unexpected request to call a number to protect an account, verify a payment, cancel an order, or prevent a service disruption, verify the request independently using the organization’s official website, application, or another trusted communication channel. Don’t assume that making the call is the safest way to resolve the issue.