The email contains no malicious URL, no weaponized attachment, and nothing for a security filter to flag. Just a phone number and an invoice for a subscription the recipient never purchased.
It arrives looking like a billing issue. An email from what appears to be Norton, or Geek Squad, or PayPal, referencing a charge the recipient does not remember authorizing: a subscription renewal for $349, an invoice for a service never requested. The message is brief and professional, and it contains exactly one call to action: a phone number to call if the charge was made in error.
There is no link to click, no attachment to open, and nothing for an email security gateway to flag. Callback phishing bypasses the technical infrastructure organizations have built to intercept phishing because the payload is not in the email. It is in the conversation that follows when the recipient picks up the phone.
On the other end is an operator working from a script, impersonating the brand’s customer support team, ready to walk the caller through “resolving” the charge. The resolution involves installing remote access software, visiting a site that downloads malware, or providing credentials that grant the attacker access to corporate systems. By the time the interaction ends, the caller has voluntarily given the attacker everything they need. Trustwave researchers documented a 140 percent surge in callback phishing between July and September 2024 alone. Proofpoint’s data shows roughly 10 million of these messages going out every month.
Where callback phishing came from
In 2020, a campaign known as BazarCall pioneered the technique at scale. Operators sent emails impersonating antivirus companies, warning recipients that a free trial was about to auto-renew at a premium price. Recipients who called the number reached an attacker who guided them through downloading what they believed was an uninstall tool. It was BazarLoader, a remote access trojan that provided the initial foothold for ransomware deployment.
BazarCall worked well enough to attract imitators. The Conti ransomware group adopted the playbook. When Conti dissolved in 2022, its splinter groups carried the technique forward. Luna Moth, also tracked as Silent Ransom Group, refined the approach for data extortion: rather than encrypting files, Luna Moth’s operators used callback phishing to gain remote access, exfiltrate sensitive data from legal and financial services firms, and demand payment to prevent its release. Quantum and Royal ransomware followed the same pattern. By 2024, the 3AM ransomware group had adopted callback phishing as its primary initial access method.
The reason it spread is simple. Callback phishing consistently gets past the defenses that stop traditional phishing, and every ransomware operator who tried it kept using it.
Why the phone call changes everything
What makes callback phishing effective is not sophistication but a deliberate inversion of the attack’s direction.
In a traditional vishing attack, the attacker calls the victim. That cold call triggers suspicion: the caller ID might look wrong, the timing feels off, and security training has taught employees to be skeptical of unsolicited calls. Callback phishing reverses the dynamic entirely. The victim calls the attacker. They initiated the contact, they are seeking resolution to a problem they believe is real, and that act of initiation creates a psychological commitment that an inbound call cannot replicate. The person on the other end sounds exactly like the customer support representative they expected to reach.
What follows is pure social engineering. The operator references the specific charge from the email, uses the brand’s standard support language, and walks the caller through a resolution process that feels entirely normal. Installing a remote support tool like AnyDesk or TeamViewer to “help investigate the charge” is a routine request in legitimate customer support. The victim complies because the interaction matches their mental model of what technical support looks like.
And email security tools are structurally blind to all of it. The email contains none of the artifacts they are designed to intercept: no malicious URL, no suspicious attachment, no executable payload. Clean text with a phone number. Everything malicious happens in a voice conversation that no email filter can reach.
The brand impersonation at the center
Every callback phishing campaign is built on brand impersonation. From the initial email to the phone operator who answers, the caller’s entire experience is mediated through a fabricated version of a company they trust.
The brands that appear most often are the ones whose names carry weight in a billing context. Norton, McAfee, and Geek Squad for tech support. PayPal and Amazon for payment disputes. Netflix and QuickBooks for subscription renewals. Increasingly, cryptocurrency platforms like Binance. What these brands share is a legitimate customer service infrastructure that customers expect to call. The callback phishing email exploits that expectation. The recipient does not think “this might be a phishing email” because the email is not asking them to click anything. It is asking them to do exactly what a real billing dispute would require: call the company.
For the brands being impersonated, the exposure is both reputational and operational. Customers who fall for an attack impersonating Norton associate the fraud with Norton, not with the anonymous operator who answered the phone. Customer service teams field calls from victims seeking help with damage caused by someone pretending to be their organization. The fraudulent phone numbers, the fake support pages, and the fabricated invoices bearing the brand’s logo are all components of a campaign that operates entirely outside the brand’s own infrastructure.
The Bottom Line
Callback phishing has grown from a single ransomware campaign’s innovation in 2020 to a standard technique used across the threat landscape, with 10 million messages sent monthly and adoption by at least five major ransomware operations. It works because it bypasses every technical control designed to stop phishing: no link, no attachment, no malicious code in the email. The attack lives in the phone call, and the phone call is powered by brand impersonation from start to finish. For organizations whose brands are being used as the pretext, the exposure is not limited to the customers who fall for the scam. It extends to the erosion of trust in the brand’s legitimate communications and the operational burden of supporting victims who believe they were defrauded by the real company.
Key Takeaways
Callback phishing, also known as telephone-oriented attack delivery (TOAD), is a social engineering attack that begins with an email containing a phone number instead of a malicious link or attachment. The email typically impersonates a recognizable brand and references an unauthorized charge. When the recipient calls, an attacker posing as customer support guides them through installing malware, providing credentials, or granting remote access.
Proofpoint data shows approximately 10 million callback phishing messages are sent monthly. Trustwave documented a 140 percent surge in callback phishing between July and September 2024. Agari reported that hybrid phishing attacks, which include callback phishing, have increased 625 percent overall. At least five major ransomware operations have adopted the technique since its emergence in 2020.
Callback phishing emails contain no malicious URL, no weaponized attachment, and no executable payload. The email is a clean text message with a phone number. Email security gateways scan for malicious links, suspicious attachments, and known threat indicators, none of which are present. The attack’s entire malicious component exists in the voice conversation that follows.
BazarCall pioneered callback phishing in 2020 to deliver the BazarLoader trojan for ransomware deployment. The Conti ransomware group adopted the technique. After Conti dissolved, splinter groups including Luna Moth, Quantum, Royal, and 3AM all continued using callback phishing as an initial access method. The technique has become a standard component of the ransomware operational toolkit.
Every callback phishing campaign impersonates a specific brand in both the email and the phone interaction. Norton, Geek Squad, PayPal, Amazon, and Netflix are among the most frequently impersonated. Victims who fall for the attack associate the resulting fraud with the impersonated brand. The infrastructure supporting these campaigns, including spoofed invoices, fake support pages, and lookalike domains, represents detectable impersonation that operates outside the brand’s own systems.
