# Real-Life Callback Phishing Examples and How to Protect Your Business Source: https://keepnetlabs.com/blog/real-life-callback-phishing-examples-and-how-to-protect-your-business Published: 2024-11-08 Updated: 2026-10-10 Author: Ozan Ucar, Founder and CEO of Keepnet Category: Social Engineering > Explore 11 real-world callback phishing examples, from fake subscription renewals to IT help desk impersonation, the tactics attackers use in each one and how to protect your organisation. The **callback phishing examples** below show how attackers move a scam from the inbox to the phone: an email with no link asks the employee to call a number, and the real attack happens on the call. Attackers use [**social engineering**](https://keepnetlabs.com/blog/what-is-social-engineering-what-are-the-ways-of-prevention) techniques, urgency and trust-building to gather sensitive information once the victim is on the line. Because callback phishing relies on direct, real-time communication, it can be harder to detect and prevent. To counter this growing threat, companies should focus on [**security awareness training**](https://keepnetlabs.com/products/security-awareness-training), [**phishing simulations**](https://keepnetlabs.com/products/phishing-simulator), **and** [**incident response planning**](https://keepnetlabs.com/products/incident-responder). These strategies help employees recognize the warning signs of callback phishing and respond correctly to potential threats. Let’s look at 11 real-world callback phishing examples and how companies can protect themselves from each type of attack. ## How the Attacks in These Examples Work [**Callback phishing**](https://keepnetlabs.com/blog/what-is-callback-phishing-how-can-you-protect-your-business-against-callback-phishing-in-2024) is a phishing tactic where attackers trick employees into calling a phone number provided in a fake email. Unlike typical phishing, which tries to gather information directly through email, callback phishing uses a phone call to engage the target. Once employees call, attackers use **social engineering**, often citing urgent account issues or payment verifications, to collect sensitive details. This method bypasses traditional email security since the interaction happens outside of email, making it harder to detect and block. By shifting channels, attackers gain employees’ trust and use this connection to extract confidential information. Check out our blog to learn more about [what is callback phishing and how it works](https://keepnetlabs.com/blog/what-is-callback-phishing-how-can-you-protect-your-business-against-callback-phishing-in-2024). ### Why These Attacks Keep Working **Callback phishing**is growing in popularity because of its high success rate, especially as attackers develop more sophisticated methods that make these phishing calls look like legitimate, professional communications. Cybercriminals often use trusted names, like banks, IT support desks, or popular services, to create a sense of urgency or authority. This tactic makes employees feel a false sense of urgency or trust, leading them to follow instructions they would normally question. The evolving tactics of callback phishing call for stronger organizational defenses, including [**Security Awareness Training**](https://keepnetlabs.com/products/security-awareness-training) and [**Phishing Simulations**](https://keepnetlabs.com/products/phishing-simulator) that prepare employees for these types of scenarios. Below, we explore **11 real-world callback phishing examples** that illustrate how these schemes operate and why targeted training is essential. ## 1. Fake Subscription Renewals Imagine your accounting team receives an email about an “urgent renewal” for antivirus software, warning that a significant charge is about to be processed. The email provides a phone number to call immediately if they wish to cancel. When they call, they’re connected to a fake support agent who appears helpful but is actually gathering sensitive company details, such as payment information or login credentials. **Phishing simulations** can help employees recognize red flags in these scenarios, like unexpected renewal requests, urgent payment claims, or unfamiliar contact numbers. With training, employees learn to verify such requests independently, helping them avoid falling victim to these convincing scams. To assist with verification, they can also use tools to determine is this number a VoIP, cell or landline, which can help identify suspicious or non-traceable phone numbers commonly used in scams, making it easier to spot and avoid fraudulent contact attempts. ## 2. Impersonated Bank Alerts Attackers posing as bank representatives alert employees to “unusual transactions” on the company’s account, creating a sense of urgency. The email provides a “secure” phone number to call for assistance. When employees call, they reach a fake support agent who requests sensitive account details, claiming it's necessary for verification. ![image5.png](https://timely-benefit-e63d540317.media.strapiapp.com/image5_caf82b6dc2.png) ![Keepnet Callback Phishing Scenario.png](https://timely-benefit-e63d540317.media.strapiapp.com/Keepnet_Callback_Phishing_Scenario_892d0685e1.png) *Picture 1: Keepnet Callback Phishing Scenario* **Security Awareness Training** and **Phishing Simulations** focused on callback phishing help employees recognize red flags in high-pressure requests like these. Training modules on [spear phishing](https://keepnetlabs.com/blog/10-examples-of-spear-phishing-attacks) and realistic simulations give employees practical tools to verify unusual transfer requests with company leaders before taking action, helping prevent costly mistakes. ## 4. Fake Vendor Invoices Attackers often target businesses that regularly interact with vendors by sending fake invoices that appear to come from trusted vendors. These invoices, sent from spoofed email addresses, include a callback number for “verification.” When employees call, the attacker pretends to confirm invoice details but instead collects sensitive financial information. **Human Risk Management** tools help reduce exposure to such attacks by monitoring and addressing common human errors. This proactive approach ensures employees are trained to verify invoices and vendor communications independently, preventing them from falling victim to such scams. ## 5. Technical Support Scams In this type of scam, phishing emails presented as technical support alerts warn employees of “critical issues” with company systems. The email includes a callback number, urging employees to call for immediate assistance. When they call, attackers posing as support agents request login credentials, claiming it’s necessary to resolve the issue. ![picture.png](https://timely-benefit-e63d540317.media.strapiapp.com/picture_f883d88bb8.png) ![Keepnet Callback Phishing Scenario.png](https://timely-benefit-e63d540317.media.strapiapp.com/Keepnet_Callback_Phishing_Scenario_4d68d9f70e.png) *Picture 2: Keepnet Callback Phishing Scenario* Through **Security Awareness Training**, employees can learn to recognize suspicious support requests, verify legitimate support contacts, and avoid falling victim to these social engineering tactics. Training prepares them to question unexpected technical requests, reducing the risk of unauthorized access. ## 6. Account Suspensions and Access Recovery In this tactic, attackers impersonate support staff from services like Microsoft 365 or Google Workspace, notifying employees of a “temporary account suspension.” The email instructs employees to call a provided number to “restore access.” When employees call, the attackers, posing as support agents, collect login credentials under the guise of account recovery. **Security Awareness Training** can teach employees to verify account suspension messages by contacting the service provider directly through official channels. Instead of using phone numbers provided in suspicious emails, employees should be trained to access support through verified portals or official contact details, ensuring they’re speaking with legitimate representatives and protecting sensitive information from phishing attempts. ## 7. Charity Donation Scams In this scam, cybercriminals exploit employees' goodwill by posing as representatives of charitable organizations. They call employees, requesting donations for a cause and ask for credit card information under the pretense of “verifying the transaction.” Once employees provide payment details, attackers capture this sensitive information for fraudulent use. **Security Awareness Training** and **Phishing Simulators** can help employees recognize emotionally manipulative tactics like these. Simulated phishing exercises focused on fake donation requests, combined with training on identifying red flags and verifying requests, are effective ways to reduce the risk of falling victim to charity donation scams. In addition to training, nonprofits should also use secure platforms to safeguard against fraud. Tools with strong [protection from spam and carding attacks](https://donorbox.org/nonprofit-blog/spam-donations-carding-attacks-donorbox-security) can help prevent malicious donation activity and keep donor data safe. ## 8. Subscription Cancelation Scams for Popular Services In this scam, attackers pose as representatives from popular services like Netflix or Amazon, claiming there is an issue with the employee’s subscription. The email or message instructs employees to call a number for “account verification.” When employees call, the attackers request personal or payment information under the guise of resolving the issue. **Phishing simulations** that mimic these common subscription scams can help employees learn to distinguish between legitimate support requests and callback phishing attempts. With practice, employees become better equipped to recognize suspicious prompts and verify requests before sharing sensitive information. ## 9. IT Department Impersonation In this type of scam, cybercriminals impersonate the internal IT department, notifying employees of “urgent software updates” or “required password resets.” The message includes a phone number to call for assistance. When employees call, they are connected to attackers who request login credentials under the pretense of helping with the update or reset, posing a significant security risk. **Security Awareness Training** with realistic **IT support scenarios** helps employees learn how to handle urgent requests safely. These training programs simulate common IT requests, such as software updates or password resets, and teach employees how to verify them through official channels. This approach equips employees to protect company information and avoid sharing sensitive credentials with unauthorized parties. ## 10. Fake HR Communications In this scam, attackers impersonate HR representatives, sending messages about “updates on benefits” or “important account changes” and prompting employees to call a provided number for more information. When employees call, the attackers posing as HR staff request sensitive personal data, such as Social Security numbers or bank details. **Security Awareness Training** helps employees learn to validate HR communications before sharing personal information. By teaching employees to confirm HR-related requests through official channels, this training helps reduce the risk of data breaches caused by callback phishing scams targeting HR topics. ## 11: SMS-Delivered Callback Phishing Not all callback phishing attacks start with an email. In this example, a fake Barclays SMS claimed that a payment had been placed on hold and instructed the recipient to reply “Y” or call a support number. The goal was to convince the victim to initiate contact with the attacker. This tactic is a classic form of [callback phishing](https://keepnetlabs.com/blog/what-is-callback-phishing-how-can-you-protect-your-business-against-callback-phishing-in-2024) and is closely related to [TOAD](https://keepnetlabs.com/blog/how-toads-are-attacking-businesses-risks-impacts-and-solutions) (Telephone-Oriented Attack Delivery) and [vishing attacks](https://keepnetlabs.com/blog/what-is-vishing), where cybercriminals use phone conversations instead of malicious links to manipulate victims into revealing sensitive information. I got this one on iMessage, not email, which is the whole point. A Philippines number sent a fake Barclays alert about a £452.75 payment on hold, with no link, just "reply Y or call this number." Out of curiosity I called, and a real person picked up straight away, no hold music, ready to talk me through "securing" my account. That is callback phishing, and it never went near a mail gateway. Related reading: [Callback Phishing Explained](https://keepnetlabs.com/blog/what-is-callback-phishing-how-can-you-protect-your-business-against-callback-phishing-in-2024) | [TOAD Attacks Explained](https://keepnetlabs.com/blog/how-toads-are-attacking-businesses-risks-impacts-and-solutions) | [What is Vishing](https://keepnetlabs.com/blog/what-is-vishing) ![Example of an SMS-Delivered Callback Phishing Message Impersonating Barclays](https://timely-benefit-e63d540317.media.strapiapp.com/Example_of_an_SMS_Delivered_Callback_Phishing_Message_Impersonating_Barclays_58c44dee8d.png) *Picture 3: Example of an SMS-Delivered Callback Phishing Message Impersonating Barclays* > I got this one on iMessage, not email, which is the whole point. A Philippines number sent a fake Barclays alert about a £452.75 payment on hold, with no link, just "reply Y or call this number." Out of curiosity I called, and a real person picked up straight away, no hold music, ready to talk me through "securing" my account. That is callback phishing, and it never went near a mail gateway. > > — Ozan Ucar, Founder and CEO of Keepnet ## Real Case Study: Founder and CEO of Keepnet’s Encounter with Callback Phishing Recently, **Founder and CEO of Keepnet Ozan Ucar** experienced a **real-life callback phishing attempt**. On **January 28, 2025**, at exactly **4:51 PM**, he received an email designed to impersonate QuickBooks. The email included an attached file and a phone number to call for further assistance. ![Picture 3: Example of a Callback Phishing Scam Email](https://timely-benefit-e63d540317.media.strapiapp.com/Picture_3_Example_of_a_Callback_Phishing_Scam_Email_a604172e06.png) *Picture 4: Example of a Callback Phishing Scam Email* Curious about the phishing attempt, he first checked the attached file on **VirusTotal**. Surprisingly, **none of the 63 threat engines flagged the file as malicious**. You can see the **VirusTotal report** here: 🔗 [**VirusTotal Report**](https://www.virustotal.com/gui/file/392cdffc483ef73b06e276c9f1a63a9e63e6ca033c8a7463d70d0c114a440e3d) To investigate further, he called the number. A **scammer answered the call and instructed him to install remote access software** named "**Awaray**". When Ozan mentioned he was using a MacBook, the attacker quickly adapted their approach, **requesting him to install another remote access tool** instead. Fortunately, the phone connection was unstable, disrupting the attacker’s plans. However, this incident highlights **how persistent and adaptable cybercriminals have become**. Even experienced **cybersecurity professionals can become targets**. This case study underscores the **importance of security awareness training** and **realistic phishing simulations** to prepare employees against these evolving **callback phishing tactics**. ## A 2026 case that runs the other way: the help desk passkey call Every example above starts with a message, including the IT department impersonation at number nine. Google Threat Intelligence Group published reporting in August 2026 on the UNC6671 extortion cluster, where the call comes first and no message is ever sent. It belongs alongside these examples because the target is the same and the outcome is worse. The caller claims to be internal IT. The request is a FIDO2 passkey enrolment or an MFA update, framed as a deadline rather than a threat. The call lands on a personal mobile, outside corporate call controls, and in some campaigns the corporate help desk number appears on the display. The employee is directed to an enrolment page that mirrors the company sign-in, and the credential and MFA response are relayed to the real login while the call is still connected. The financial scale matches the effort. Google Threat Intelligence Group tracked 18 Bitcoin addresses tied to the BlackFile brand between 7 January and 12 May 2026 and recorded 141.65 BTC received, about 10.69 million US dollars at the time of the transactions. Initial demands ran between 1 and 3 million dollars and were typically settled 50 to 75 percent lower, averaging near 750,000 dollars. For anyone building a scenario library, this is the example to add next. It tests a behaviour none of the ones above reach: whether an employee will complete an identity change on a call they did not start. Source: Google Threat Intelligence Group, UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments, August 2026. ## How Callback Phishing Affects Your Organization Callback phishing is more disruptive than typical email threats, as it directly targets employees' trust and urgency by getting them on a call. Attackers use conversational tactics to extract sensitive information, leading to serious consequences for organizations: - **Data Breaches**: Employees unintentionally reveal confidential information, causing data leaks and possible fines. - **Reputation Damage**: A successful phishing attack can erode trust with clients and partners, impacting business relationships. - **Financial Losses**: Beyond direct fraud, organizations face indirect costs such as lost productivity and resources spent on damage control and recovery. ## Protecting Your Company Against Callback Phishing with Keepnet As **callback phishing** (or voice phishing) threats grow, companies need effective solutions to train and prepare employees. Keepnet provides this with its [**Callback Phishing Simulator**](https://keepnetlabs.com/products/callback-phishing), offering over **250 customizable templates** in 7 languages. This simulator enables organizations to run realistic phishing exercises, helping employees develop strong detection skills and a proactive security mindset. Additionally, here’s how Keepnet’s platform protects against callback phishing: - [**Security Awareness Training**:](https://keepnetlabs.com/products/security-awareness-training) Tailored modules cover common social engineering tactics, ensuring employees are vigilant and prepared. - [**Human Risk Management**:](https://keepnetlabs.com/blog/what-is-human-risk-management) Risk tracking tools provide insights for targeted training, reducing susceptibility to phishing. - [**Incident Response**:](https://keepnetlabs.com/products/incident-responder) Keepnet’s tools enable quick analysis and containment of phishing incidents, ensuring fast, coordinated responses. For further reading, check our comprehensive article to dive deeper into [most common examples of phishing emails](https://keepnetlabs.com/blog/most-common-phishing-email-examples-keepnet). Video: **Security Awareness Training** equips employees to recognize these types of scams, teaching them to spot warning signs like unexpected transaction alerts and unfamiliar contact numbers. This training helps significantly reduce the risk of falling for callback phishing scams. ## 3. CEO Impersonation for Urgent Wire Transfers In a [CEO impersonation scam](https://keepnetlabs.com/blog/ceo-fraud), attackers impersonate the CEO and send an urgent email to the finance team, claiming a critical wire transfer needs immediate processing. The email includes a phone number for “urgent verification.” When employees call, they are directed by scammers to wire funds to fraudulent accounts, believing they are following legitimate instructions. ***Editor's Note: This article was updated on June 3, 2026***. Video: Video: ## Frequently Asked Questions ### What do these callback phishing examples have in common? Callback phishing sends a message with no link and no attachment, usually a fake invoice or subscription renewal, and asks the recipient to call a number. The attack happens on the phone, where email filters cannot see it. ### Why is callback phishing so effective? There is nothing malicious in the email itself, so it reaches the inbox, and the victim initiates the call, which makes the interaction feel safe. Once on the call, the attacker guides them to install remote access software or disclose credentials. ### What are the common callback phishing scenarios? Fake subscription renewals, impersonated bank alerts, fake vendor invoices, technical support warnings, account suspension notices and charity appeals. Each one gives the victim a reason to act quickly. ### How do you spot a callback phishing email? An unexpected charge, a phone number supplied inside the message, pressure to call within a short window, and no way to verify the transaction in your own account. Verify through a number you already hold, never the one in the email. ### What should an employee do after calling the number? Report it even if nothing was installed, because the attacker now knows the number reaches a real person. If remote access software was installed, disconnect the device and escalate immediately. ### How do you measure exposure to callback phishing? Run callback simulations and record who calls, what they disclose and how quickly they report. Phone centric simulations fail at roughly 40% higher rates than email, where the median click rate sits near 1.4% (Verizon, 2026 Data Breach Investigations Report, 2026, p. 50). ### Does callback phishing always start with an email? The callback variety does, because the number has to reach the victim somehow. The same objective is also pursued with outbound calls that involve no message at all. Google Threat Intelligence Group reported in August 2026 that the UNC6671 cluster calls employees directly while posing as internal IT and asks them to enrol a passkey or update MFA. Programmes that only rehearse the callback direction leave that variant untested.