What is callback phishing?
Callback phishing, also called telephone-oriented attack delivery (TOAD), is an attack in which an email or text contains no link, only a phone number to call about a charge, a subscription or a security problem. On the call, the attacker talks the person into installing remote access software or sharing credentials.
How it works
Because the message carries no link or attachment, email filters have little to detect. The real attack happens on the phone, where the attacker can adapt to the target.
Fake invoices for software renewals and fake security alerts are common lures.
Why it matters
Callback phishing combines two channels to get around the defenses each one has. People need to recognize the pattern in both.
