Callback phishing (TOAD)

Callback phishing, also called telephone-oriented attack delivery or TOAD, sends a lure containing no link and no attachment, only a phone number and a reason to ring it. Because there is nothing malicious in the message, email filtering has little to detect, and the victim initiates the contact themselves.

This library records 3 cases.

How the attack runs

1. A believable notice arrives: an unexpected charge, a subscription renewal, a security alert.
2. No link is included, which both defeats filtering and reassures the recipient.
3. The victim calls, and having initiated contact is more disposed to trust the person answering.
4. A prepared operator handles the call, often with hold music and a scripted queue.
5. The objective follows: remote access, a payment, or credentials.

Documented cases

• The Azure Monitor billing scam (2026): attackers configured a genuine Azure alert rule so Microsoft’s own mail servers sent a fully authenticated fake Windows Defender billing notice for $459.90. It passed SPF, DKIM and DMARC because it was real mail from a real Microsoft service.
• NTS IT Care (2020, $4.9M FTC judgment): fake security pop-ups drove victims, mostly older Americans, to call for help.
• A New Zealand bank-impersonation scam (2024, about $30,000): the bank’s real number was spoofed so a callback appeared to confirm legitimacy.

How it differs from related techniques

Phishing asks for a click; this asks for a call. Vishing is attacker-initiated, whereas here the victim dials. Tech-support scams are the most common payload.

The control that would have stopped it

• Authentication is not authenticity. The Azure case passed every email check because the infrastructure was genuine; treat passing SPF and DMARC as no evidence of intent.
• Never use a number supplied in a message. Use the one on the card, the statement, or the official site.
• Recognise that dialling out feels safe and is not. This is the specific belief the technique exploits.
• Monitor cloud alerting configuration, since attacker-created rules in legitimate services are a live delivery channel.
• Never grant remote access on an inbound-prompted call.