Voicemail phishing emails: how to spot fake missed call alerts

"You have a new voice message (0:42) from +1 (555) 012-3456. Play message." Missed call alerts are routine, short and a little urgent, which makes them a favorite lure. The "recording" is usually a web page that asks for your password, or a file that installs something. This guide explains how fake voicemail emails work, how to spot them, and how to check your real phone system in seconds.

What is a voicemail phishing email?

It's an email dressed as a notification from a phone system such as Microsoft Teams, RingCentral or a desk-phone provider. It says you missed a call or received a voicemail and offers a button or attachment to play it. Some versions call it a fax or a "voice message".

Microsoft sees the theme often. Its Tycoon2FA report lists lures including "generic notifications (like voicemail and shared document access)". Its September 2026 report on device code phishing includes "voicemail and eFax" among the themes.

Voicemail phishing by email is different from vishing, where the criminal phones you, and from callback phishing, where an email tells you to call them. Here the phone theme is just a costume for an ordinary phishing email.

How do fake voicemail emails work?

The "audio" attachment that's really a web page

The most common version attaches a file named like a recording but in a web format. In its Q1 2026 email threat report, Microsoft described a campaign with "a voice message notification" theme and SVG attachments with names such as PLAY_AUDIO_MESSAGE__<Recipient Name>_...svg and Listen_(...).svg. Each file name carried the recipient's encoded email address, and some also carried their name, to make it look personal.

HTML and SVG files open in your browser and can run scripts. They can draw a fake sign-in page locally or redirect you to one. Microsoft's Q2 2026 report says "HTML attachments held the top position across all three months at 35–41% of attacks." See why HTML and SVG attachments are risky.

The nested email that ends in malware

Not every voicemail lure wants a password. Microsoft's Q2 2026 report describes a campaign on June 14–15, 2026 that targeted "more than 107,000 users" at "nearly 19,000 organizations". Each message carried "a nested EML posing as a Teams archive recording" plus a calendar invite. Opened, the EML "displayed a voicemail notification with a single action button." That button pointed at Microsoft's real sign-in address, which redirected the user to a public attachment-hosting service serving a Windows batch file called Financial_report.bat. Microsoft says the campaign "ultimately resulted in silent malware execution."

The lesson: the first link going to a real Microsoft address doesn't make it safe.

The link to a fake sign-in page

The simplest version has a "Play" or "Listen" button linking to a page that copies the Microsoft 365 or Google sign-in screen. It often sits behind a CAPTCHA. Microsoft says the Tycoon2FA kit's CAPTCHA pages were "designed to block automated scanners and ensure real users reach the phishing content." Our guide to fake Microsoft login pages shows how to tell those pages apart.

What does a real voicemail email look like?

Know your own system's notifications, and the fakes stand out. For Microsoft Teams, Microsoft Learn documents Cloud Voicemail precisely:

• "A voicemail in Exchange is an email message with an audio file attachment."
• It's sent from noreply@skype.voicemail.microsoft.com, and the From field shows the caller's phone number with that address.
• It includes the transcription, if your admin turned that on.
• The same voicemail appears in Outlook under Search Folders > Voice mails, and in Teams under the Calls tab.

Microsoft also notes that Cloud Voicemail messages "are not DKIM-signed." So don't judge a voicemail email by a missing DKIM signature alone. Check it against the phone system instead.

If you use another provider, open one genuine notification and note the sender address, how the audio arrives, and whether it ever asks you to sign in.

What are the red flags of a fake voicemail email?

• The attachment isn't audio. An "audio" file ending in .html, .htm, .svg, .shtml or .eml, or a PDF with a QR code. Turn on file extensions on Windows so you can see them.
• It asks you to sign in to play the message. The goal is your password.
• The sender isn't your phone system. Compare it with a real notification.
• Your name or email address is in the file name. Personalization like this is a phishing kit feature.
• You don't use voicemail by email, or your company doesn't have a phone system at all.
• Odd caller details. A missing number, an unknown "Voice Services" company, or a duration but no caller.
• A CAPTCHA before the message. Phishing kits use these gates to keep security scanners away from the fake page.

How do you check whether a voicemail is real?

1. Don't open the attachment or click Play.
2. Open your phone app. In Teams, go to Calls and look at voicemail. For a desk phone or another provider, use its app, web portal or the phone itself.
3. If the message is there, play it there. You never need the email.
4. If it isn't there, the email is fake. Report it.
5. Not sure who your provider is? Ask IT, using your usual ticket system or phone number, not by replying to the email.

What should you do if you already opened it?

Your response depends on what happened. Our guide to what to do after clicking a phishing link has the full checklist.

To report it, use Report > Report phishing in Outlook, or your mail app's report option. See how to report a phishing email.

Why do spam filters miss some voicemail phishing?

Voicemail lures are built to get past automated checks:

• The payload is local. An HTML or SVG attachment has no web link for a scanner to follow until it runs in a browser on the user's computer.
• CAPTCHA gates. When the attachment does lead to a web page, the page may sit behind a CAPTCHA that stops automated scanners from seeing the fake sign-in form.
• Real addresses in the chain. In the June 2026 campaign, the button pointed at Microsoft's real sign-in service at login.microsoftonline.com, which then redirected to the malware on a legitimate attachment-hosting service. Microsoft notes that because the link routed through Microsoft's authentication infrastructure, recipients and URL scanners saw a Microsoft sign-in address rather than the attacker's domain.
• Fresh variations. File names, wording and hosting change from campaign to campaign, so content signatures go stale quickly.

That's why checking the attachment type is so effective. A filter doesn't have to understand what an HTML file does to decide that a voicemail shouldn't arrive as one.

How can a business block voicemail phishing?

Filter by attachment type

The most effective single control is attachment-type filtering. Your users don't need HTML, SVG or EML attachments from outside the company in most cases. Quarantine them so an admin can release the rare genuine one. The joint CISA phishing guidance recommends denylists at the email gateway, including for file extensions and "mislabeled file extensions", the trick these fake recordings rely on.

Know your legitimate senders

Make sure your phone system's notification address is documented and that staff know it. In Microsoft 365, Microsoft warns not to create rules that block noreply@skype.voicemail.microsoft.com, or users won't receive real voicemails.

Protect the accounts behind the fake pages

Most voicemail phishing is after an email password. Phishing-resistant MFA, such as passkeys or FIDO2 security keys, means a stolen password and code can't be replayed. See AiTM phishing and MFA bypass.

Make reporting easy

A quick report lets IT find and remove the same email from every mailbox. Campaigns like the one Microsoft described in June 2026 hit thousands of organizations in two days, so speed matters.

Next steps

1. Show staff what a real voicemail notification from your phone system looks like, and tell them to check voicemail in the phone app, never from an email.
2. Quarantine inbound HTML, SVG and EML attachments from outside your organization.
3. Make sure every mailbox has MFA, and plan phishing-resistant methods for high-risk roles.
4. Check a suspicious notification's real sender in the free Email Header Analyzer. iBlockSpam's filtering includes attachment-type filters you can set per domain.

Browse our other phishing and threat guides.