# Callback phishing: why fake invoice emails ask you to call

URL: https://iblockspam.com/blog/callback-phishing-phone-scam-emails
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Phishing & threats
Author: iBlockSpam Team

> Callback phishing (TOAD) emails fake an antivirus, Geek Squad or PayPal charge and push you to call. Why filters miss them and what to do next.

## Short answer

Callback phishing is an email, often a fake renewal invoice for antivirus, Geek Squad or PayPal, that tells you to call a number to cancel or dispute a charge. The person who answers is the scammer, who wants remote access, card details or a 'refund' payment. Don't call. Check the charge in your real account and report the email.

"Thank you for your order. Your Norton 360 subscription has been renewed for $399.99. If you did not authorize this charge, call our billing department within 24 hours." There's no link and no attachment, just a phone number. That's the point. Callback phishing moves the attack off email, where your filters work, and onto the phone, where a skilled talker does. This guide explains how it works, why filters struggle with it, and what to do if someone has already called.

## What is callback phishing?

Callback phishing is an email that persuades you to phone the attacker. Security vendors also call it telephone-oriented attack delivery (TOAD). It usually looks like:

- An auto-renewal invoice for antivirus or "tech support", using names like Geek Squad, Norton or McAfee
- An order confirmation for an expensive item you didn't buy
- A PayPal invoice or money request with a note saying "call us if you didn't authorize this"
- A subscription or free trial that's "about to be charged"

The [FTC](https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams) describes the pattern: scammers "send notices about automatic renewals for tech support subscriptions," and "use the names of well-known companies like Geek Squad, McAfee, and Norton." The message "says you must call a phone number within 24 hours if you want to dispute the charge."

It overlaps with two other scams we cover: [fake invoice emails](https://iblockspam.com/blog/fake-invoice-and-payment-emails), which want you to pay a bill, and [gift card scams](https://iblockspam.com/blog/gift-card-scam-emails), which are often the cash-out at the end of a callback call.

## How big is the problem?

Callback phishing feeds into what the FBI counts as tech support fraud. The IC3's [2025 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) recorded 47,794 Tech/Customer Support complaints in 2025, with reported losses of $2,134,675,818. The report's foreword says 2025 losses were led by investment fraud, "followed by business email compromises and tech support scams." Not every one of those complaints started with an email, but many tech support scams do.

Older people are hit hardest. In a [September 2023 PSA](https://www.ic3.gov/PSA/2023/PSA230929), the IC3 said that between January and June 2023, "19,000 complaints related to tech support scams" were submitted, with estimated losses of over $542 million. Almost 50% of victims were over 60, and they accounted for 66% of the losses.

## How does a callback phishing attack work?

1. **The email.** A fake invoice or renewal notice with a large, plausible amount and a phone number. Often there's no link, and sometimes the details sit in a PDF or image.
2. **The call.** You ring the number to cancel. A friendly "billing agent" answers and offers to help with the refund.
3. **The access.** The agent asks you to install a remote access tool or visit a "cancellation" website. The FTC says they take you "to a spoofed website that looks real" and ask for bank or card details to process the refund.
4. **The trick.** They claim the refund went wrong and you were paid too much. The FTC says they then insist you pay it back "with gift cards, a wire transfer, a bank transfer, cryptocurrency, or a payment app."
5. **The damage.** With remote access, they can steal banking logins, install malware or, on a work computer, open the door to the whole network.

### The business version: from phone call to ransomware

Callback phishing isn't only a consumer scam. In 2021, [Microsoft described the BazaCall campaign](https://www.microsoft.com/en-us/security/blog/2021/07/29/bazacall-phony-call-centers-lead-to-exfiltration-and-ransomware/), whose emails claimed a free trial was ending and that the user's "credit card will soon be automatically charged." The call center agent told victims to download a "cancellation" file, a macro-enabled Excel document that installed malware. Microsoft linked the follow-up activity to data theft and ransomware.

CISA's advisory [AA23-025A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a) describes help desk-themed phishing emails sent to US federal staff. Some asked recipients to call the actors. The criminals then used legitimate remote tools, ScreenConnect and AnyDesk, run as portable programs, to "initiate a refund scam": they had the victim log in to their bank while connected, changed the displayed balance to show an overpayment, and asked for the excess back.

Microsoft has also documented a related pattern without the fake invoice. In [May 2024](https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/), it described a ransomware group, Storm-1811, that flooded users' inboxes with subscription sign-ups and then phoned them posing as IT support, offering to fix the spam. Victims were persuaded to grant access through Quick Assist. Our guide to [email bombing](https://iblockspam.com/blog/email-bombing-subscription-bombing) covers that technique.

## Why do spam filters struggle with callback phishing?

Most filtering looks for bad links, bad attachments and bad senders. Callback phishing often has none of them.

| What filters look for | Typical phishing email | Callback phishing email |
|---|---|---|
| Malicious link | Yes | Often none |
| Malicious attachment | Often | None, or a harmless-looking PDF or image |
| Spoofed or new sending domain | Often | Sometimes a free webmail account, sometimes a real service |
| Fails SPF, DKIM or DMARC | Sometimes | Not if sent through a real invoicing service |
| The payload | A web page or file | A phone number |

Microsoft put it plainly in its BazaCall analysis: the campaigns "forgo malicious links or attachments in email messages in favor of phone numbers," and the "lack of obvious malicious elements in the delivery methods could render typical ways of detecting spam and phishing emails ineffective."

Some versions go further and use a real platform. [PayPal warns](https://www.paypal.com/us/cshelp/article/what-are-invoice-scams-and-money-request-scams-on-paypal-help1059) that scammers send genuine PayPal invoices and money requests whose note "may ask you to call their fake customer service number." Those emails come from PayPal's own systems, so they pass authentication checks. Only the content gives them away.

Filters still help, through content analysis, sender reputation and spotting the same message sent to many people. But this is a scam where trained people matter as much as technology.

## What are the red flags of a callback phishing email?

- **A charge you don't recognize**, for a product you don't use, usually large enough to make you want to act.
- **A phone number is the only way to respond.** No link to your account, no customer number you recognize.
- **A short deadline.** "Within 24 hours" or "before your card is charged."
- **The details are in a PDF or image.** The body is blank or nearly blank, which also hides the text from filters.
- **A personal address for a business brand.** "Geek Squad billing" from a free webmail address.
- **The invoice came through a payment service** but the note tells you to call, not to log in.
- **On the call:** a request to install software, visit a website, log in to your bank, or pay back an "overpayment".

The FTC adds two rules worth repeating: "Legitimate tech companies won't contact you by phone, email, or text message to tell you there's a problem," and real security warnings "will never ask you to call a phone number."

## What should you do with a callback phishing email?

1. **Don't call the number.** The IC3's advice is direct: "Do not contact the telephone number provided in a pop-up, text, or email."
2. **Check the charge yourself.** Look at your card or bank statement, or sign in to the company's site or app by typing the address. PayPal says to "Always log in to your account on the PayPal website or the PayPal app to verify if any action is needed." If there's no charge, the email was a scam.
3. **If you want to be sure, call the real company** using a number from its official website or the back of your card.
4. **Report it.** Use your mail app's report button and tell IT. In the US, report the scam at [ReportFraud.ftc.gov](https://reportfraud.ftc.gov). For a fake PayPal invoice, forward the email to `phishing@paypal.com` and report the invoice from your PayPal account.
5. **Delete it.**

## What if someone already called and gave remote access?

Treat this as urgent, especially on a work device.

### For the person who called

1. **Hang up and disconnect the computer** from Wi-Fi or the network cable.
2. **Tell IT straight away** if it's a work computer. Don't try to clean it yourself.
3. **Call your bank** using the number on your card if you logged in to banking, shared card details or sent money. The [FTC](https://consumer.ftc.gov/articles/what-do-if-you-were-scammed) says to ask your bank to reverse a transfer, and to call a gift card issuer using the number on the back of the card, keeping the card and the receipt.
4. **On a personal computer**, the FTC says to update your security software, "Run a scan and delete anything it identifies as a problem," and change your passwords and turn on two-factor authentication.
5. **Report the loss** to the FTC and file at [ic3.gov](https://www.ic3.gov).

### For IT

1. **Isolate the device** and check for remote access tools installed or run during the call, including portable versions.
2. **Reset the user's passwords** from a clean device, revoke sessions and remove any MFA method the user didn't add.
3. **Look for persistence and data theft.** Microsoft's BazaCall and Quick Assist reports both describe callback calls that led to further malware and ransomware.
4. **Search mailboxes** for the same email and remove it from everyone who got it.

## How can a business reduce callback phishing?

- **Control remote access tools.** CISA recommends that you "Audit remote access tools on your network to identify currently used and/or authorized RMM software," and use application controls to block portable versions of unapproved tools. Microsoft suggests "blocking or uninstalling Quick Assist and other remote monitoring and management tools" if you don't use them.
- **Publish how IT support works.** Tell staff who will contact them, how, and that real IT staff will never ask them to install a remote tool because of an email.
- **Centralize purchasing.** If software subscriptions are bought through one person or a company card, staff know a renewal email isn't theirs to handle.
- **Train on this specific scam.** Show a real example. "There's no link, so it must be safe" is the belief to break. See [security awareness training for small businesses](https://iblockspam.com/blog/email-security-awareness-training-small-business).
- **Filter for content, not just links.** Inbound filtering that weighs the message text and sender reputation, not only links and attachments, cuts how many reach users. Rules that flag invoices from free webmail senders help too.

## Next steps

1. Send your team one example of a callback phishing email this week, with the rule: never call a number from an unexpected invoice.
2. List the remote access tools your company actually uses, and block the rest.
3. Make sure staff know how to report suspicious email and who to call if they already phoned a number.
4. Check what reaches your users. The free [Email Health Check](https://iblockspam.com/tools/email-health-check) reviews your domain's setup, and iBlockSpam's [quarantine and digests](https://iblockspam.com/features/quarantine-and-digests) let users review held mail without opening it in the inbox.

Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### What is callback phishing?

Callback phishing is an email that gets you to phone the attacker instead of clicking a link. It usually claims you've been charged for a subscription or order and gives a number to call to cancel. Security vendors also call it telephone-oriented attack delivery, or TOAD. On the call, the scammer asks for remote access, card details or a payment.

### Why don't spam filters catch callback phishing emails?

There's often nothing technical to catch. Microsoft noted that these campaigns forgo malicious links or attachments in favor of phone numbers, and that the lack of obvious malicious elements could make typical spam and phishing detection ineffective. Some arrive as real invoices sent through PayPal or another payment service, which pass email authentication.

### Is a Geek Squad, Norton or McAfee renewal email real?

Usually not if you don't recognize it. The FTC says scammers use the names of well-known companies like Geek Squad, McAfee and Norton in fake renewal notices that tell you to call within 24 hours. Check your bank or card statement and your account on the company's own site. Never use the number in the email.

### I called the number and gave them remote access. What should I do?

Hang up and disconnect the computer from the internet. Tell IT if it's a work device. The FTC says to update or install security software, run a scan and delete anything it flags, then change your passwords and turn on two-factor authentication. Call your bank if you shared financial details or logged in to online banking during the call.

### Where do I report callback phishing?

Report it with your mail app's report button and to your IT team. In the US, report the scam to the FTC at ReportFraud.ftc.gov, and file at ic3.gov if you lost money. For a fake PayPal invoice, PayPal asks you to forward suspicious emails to phishing@paypal.com and report the invoice from your PayPal account.

## Sources

- [FTC: How To Spot, Avoid, and Report Tech Support Scams](https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams)
- [FTC: What To Do if You Were Scammed](https://consumer.ftc.gov/articles/what-do-if-you-were-scammed)
- [FBI IC3 PSA: 'Phantom Hacker' Scams Target Senior Citizens and Result in Victims Losing their Life Savings (September 2023)](https://www.ic3.gov/PSA/2023/PSA230929)
- [FBI IC3: 2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)
- [CISA AA23-025A: Protecting Against Malicious Use of Remote Monitoring and Management Software](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a)
- [Microsoft Threat Intelligence: BazaCall, phony call centers lead to exfiltration and ransomware (July 2021)](https://www.microsoft.com/en-us/security/blog/2021/07/29/bazacall-phony-call-centers-lead-to-exfiltration-and-ransomware/)
- [Microsoft Threat Intelligence: Threat actors misusing Quick Assist in social engineering attacks leading to ransomware (May 2024)](https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/)
- [PayPal Help: Avoid invoice and money request scams](https://www.paypal.com/us/cshelp/article/what-are-invoice-scams-and-money-request-scams-on-paypal-help1059)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/callback-phishing-phone-scam-emails (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt