What Is Callback Phishing?
Callback phishing is a scam that starts with a message, alert, invoice, or voicemail and pushes the target to call a phone number controlled by the attacker. Once the target calls, the attacker uses a live conversation to build trust, create pressure, and guide the person toward an unsafe action.
Callback phishing is a phishing method that tricks or pressures the target into calling the attacker. The first message may avoid links or attachments, making it look less suspicious, while the real manipulation happens during the phone call.
At a glance: Callback phishing moves the attack from a written message into a voice conversation, where the attacker can adapt, reassure, and pressure the target in real time.
Expanded explanation
Callback phishing is effective because the initial message may contain no link or attachment for filters or users to flag. It might be a fake invoice, subscription renewal notice, bank alert, security warning, or support message that contains a phone number instead of a suspicious link. Some users are more willing to call than click because calling feels like a safer way to verify.
The problem is that the phone number belongs to the attacker. Once the target calls, the scammer can ask questions, respond to hesitation, create urgency, and guide the person step by step. The attacker may claim to be support, billing, fraud prevention, legal, IT, or a vendor representative.
Callback phishing often blends email, phone calls, and fake websites. A message creates the reason to call. The call creates trust. Then the attacker may ask the target to visit a site, install remote access software, share a code, approve a prompt, provide payment information, or reveal business details.
For organizations, callback phishing is a reminder that a phishing campaign does not end at the inbox. A user may not click a link in the original email, but the same message can still succeed if it moves them into a phone conversation.
How Callback Phishing Works
Callback phishing usually uses a message that gets the target to place the call.
- The attacker sends a reason to call. The message may mention a charge, renewal, account problem, legal issue, support case, or suspicious activity.
- The message avoids obvious payloads. Some callback lures contain no attachment or link, which can help them look less dangerous to users and filters.
- The target calls the supplied number. The call may be answered by a person, menu, recorded prompt, or call center-style setup.
- The attacker steers the conversation. They may ask for identity details, remote access, payment information, one-time codes, or a login.
- The scam expands from the call. The target may be sent to a fake site, asked to install software, or moved into a second channel for follow-up.
Common Callback Phishing Examples
Callback phishing lures often look like billing or support issues.
- Fake subscription renewal: An email says a costly renewal is about to process and provides a phone number to cancel.
- Bank or fraud alert: A message claims suspicious activity was detected and tells the user to call a fraud department number.
- Tech support warning: The target is told their device, account, or software license has a problem that requires immediate support.
- Invoice dispute: A fake vendor message asks finance or operations to call about an invoice, payment issue, or contract problem.
- Legal or compliance notice: A message warns of a missed deadline, policy violation, or case number and directs the recipient to call for details.
Why Callback Phishing Matters
Callback phishing matters because it changes the user's mental model. A suspicious link feels risky, but a phone call can feel like verification. This overlap with vishing gives attackers a live voice channel they can use to move the target into a controlled conversation.
Calls also give attackers flexibility. If the target sounds unsure, the scammer can explain. If the target asks a question, the scammer can adapt. If the target wants proof, the scammer can point back to the original message or send a follow-up link while the conversation is active.
For businesses, the risk includes account takeover, remote access compromise, payment fraud, credential theft, and disclosure of internal information. A callback scam can also bypass email-focused awareness habits because the most persuasive part of the attack happens over the phone.
How to Reduce Callback Phishing Risk
Callback phishing prevention depends on teaching people not to trust contact information supplied by the suspicious message.
- Use official contact details. If an issue might be real, call the number on the company website, contract, app, card, or internal directory.
- Do not share codes or passwords. A caller should not ask for passwords, MFA codes, recovery keys, or full payment details.
- Block remote access pressure. Employees should not install remote access tools or screen-sharing software from an unexpected support call.
- Report the original lure. Security teams need the email, number, voicemail, attachment, or screenshot that started the call.
- Practice voice scenarios. Awareness programs should include phone-based lures so employees learn how pressure sounds in a live conversation.
Related Glossary Terms
Callback phishing is closely related to voice impersonation and broader business scams.
- Voice Cloning Attacks explains how synthetic audio can make voice-based scams more convincing.
- Business Email Compromise covers scams that abuse trusted business relationships and approval workflows.
Final Takeaway
Callback phishing works by making the victim take the next step. The original message creates concern, and the phone call turns that concern into a conversation the attacker controls.
The safest response is to break the path the attacker provides. Do not use the number in the message, do not share sensitive information on the call, and verify the issue through a channel you already trust.
Questions Teams Ask About Callback Phishing
Quick answers about phone-based phishing, callback lures, and safer verification behavior.
What is callback phishing?
Callback phishing is a scam where a message, invoice, alert, or voicemail pushes the target to call a phone number controlled by the attacker.
Why do callback phishing scams use phone calls?
Phone calls let attackers build trust, answer questions, create pressure, and guide the target through actions that might look suspicious in an email alone.
Is callback phishing the same as vishing?
They overlap. Vishing is voice phishing broadly, while callback phishing usually starts with a message that convinces the victim to place the call.
How can employees avoid callback phishing?
Employees should avoid phone numbers supplied in suspicious messages, use official contact details, report the lure, and refuse requests for passwords, codes, or remote access.