Callback Phishing

What Is Callback Phishing?

Callback phishing starts with an email and ends with a phone call. There is no link to click. The message poses as a fraud alert about a charge on your corporate card and gives a number to call. Whoever answers is a social engineer who walks you through a fake verification portal and collects your card details and banking credentials. You'll see how the call is scripted to keep you cooperating, then check with the real card issuer and report the incident.

What You'll Learn in Callback Phishing

• Recognize the structure of a callback phishing email, including fake fraud alerts and embedded phone numbers that bypass link-based detection
• Verify a fraud alert independently using the number on your card or the issuer's official website before responding
• Identify conversational manipulation tactics used by attackers on the phone, such as scripted urgency and false reassurance
• Understand why callback phishing evades traditional email security filters that scan for malicious URLs and attachments
• Follow your organization's incident reporting process when you encounter a suspected TOAD attack

Callback Phishing — Training Steps

1. A Busy Monday

   It's a busy Monday afternoon. You have a packed schedule today - two client calls this afternoon and a business trip to book for next week.

2. The Fraud Alert

   A new email arrives in Alice's inbox. The subject line catches her eye immediately - something about her corporate card.

3. Panic Sets In

   Alice's heart races. $2,847 is a significant amount, and she definitely did not make that purchase. The email mentions account suspension - that would be a disaster with the client trip next week. Despite the red flags, panic overrides caution. Alice grabs her phone and dials the number from the email: 1-888-445-9127 .

4. Identity Verification

   'Michael' sounds professional and reassuring. Before discussing the charge, he asks Alice to verify her identity, which feels like standard procedure.

5. The Secure Portal

   To finish the fraud claim, Michael sends Alice to a 'secure online portal' and stays on the line to walk her through it.

6. Opening the Portal

   Alice opens her browser and navigates to the URL Michael provided. The website looks professional with a corporate card logo and secure-looking design.

7. Guided Through the Form

   With the form open, Michael talks Alice through it field by field, so she never has a moment to stop and think.

8. Entering Card Details

   Alice enters her corporate card details as directed by Michael over the phone.

9. The Final Piece

   Michael has 'one more step' before the claim is closed, and this time he wants far more than card details.

10. Banking Credentials

    The page now shows a form asking for Alice's corporate banking portal login. Michael assures her this is the final step to complete the fraud claim.