A scam email with no link to click, only a phone number and a reason to call: that’s callback phishing. The reason sounds ordinary — an unexpected charge, a renewal, a refund or an IT problem. The person who answers poses as support. On the call, they talk the caller into letting them into the computer. One phone call can end with a stranger inside a work computer, or with money taken from a company account.

The practical rule is short. Don’t call a number from an unexpected email. Check through a number or an account you already have. And never let someone reached that way into a computer.

What Is Callback Phishing?

It’s an email built to make someone pick up the phone. Instead of a link, it carries a phone number. The message is dressed as a charge, a renewal, a refund, an account problem or a help desk notice. Nothing in it needs clicking, so the pressure sits in the call.

The Cybersecurity and Infrastructure Security Agency (CISA), with two partner organizations, sets out the pattern in a joint advisory on criminals misusing remote access software. The advisory describes criminals who sent “help desk-themed phishing emails” that could “prompt the recipients to call the cybercriminals”. That campaign targeted federal government employees.

A message like that can be hard for an email filter to judge. There may be no link and no attachment to inspect. The wording can read like an ordinary receipt or a renewal notice.

The jump from email to phone is the point. A call is a conversation. The scammer can answer doubts, sound helpful and keep the person talking.

What Happens After Someone Calls?

The person who answers poses as support, or as a refund desk. The caller gets sent to a website and asked to run a remote access program. Once it runs, the scammer can see the screen and control the computer. From there, the talk can turn to money.

CISA’s advisory adds a technical point worth understanding: “Because portable executables do not require administrator privileges, they can allow execution of unapproved software”. In plain words, some remote access programs run without being installed. A rule that only blocks installs may not stop them.

In the campaign CISA describes, callers steered people to software “which the actors used in a refund scam to steal money from victim bank accounts”. CISA also warns that the criminals could sell the access to other criminals. So the money on the call isn’t the only loss in play.

While a session is connected, a caller may see whatever the employee can open. That’s the reason the rule is to hang up before anyone gets in.

What Should Staff Do When an Email Asks Them to Call?

The rule is short enough to post by a desk. Staff don’t call the number in the email. They check through a number or an account the business already has. They never let anyone into a computer on a call that began with an email. And they report the message.

  • Don’t call the number in the email. Treat that number as part of the message, not as a fact. A real charge can be checked another way.
  • Check another way. Use the number on a past invoice, the number on the back of the card, or the company’s own site typed in by hand. Signing in to the account directly works too.
  • Never let a caller into the computer. Nothing gets downloaded on a call that started with an email. No screen gets shared, and no code gets read out.
  • Hang up and report it. Tell the person the business names for this, and keep the email so IT can look at it.
  • If someone already let a caller in, end the session and disconnect that computer from the network. Then call IT right away. As a general rule, those are the first steps.

A bad call and a bad click need the same kind of response, so the longer version of these steps sits in O&O Systems’ post on what to do after someone clicks a phishing link.

The same rule holds when the lure arrives another way. A text or a voicemail can ask for a call back, and O&O Systems covers those in a post on scam texts and voice calls.

What Should You Settle With Your IT Provider?

Three answers cover it, and they belong in writing. Which remote access program is the approved one. How a real support session starts, so staff can tell it from a fake. And who staff report a suspicious email or call to. Each one is a sentence, not a project.

CISA’s advice to network defenders includes auditing remote access tools, to see which ones are in use and which ones are authorized. A business can do a smaller version of that with its provider. Then staff get a clear line: if it isn’t the approved program, nobody runs it.

How a session starts is a decision, not a guess. The business and the provider agree on the route — staff open the request through the usual help desk channel, for example — and an unexpected call becomes easy to question. O&O Systems’ help desk page says support may involve quick remote access or hands-on service. A business that has settled how its own sessions begin has a simple test for anything that doesn’t match.

One person, not a vague instruction to tell somebody. Name them, and say the other half out loud: reporting is never punished. A report that turns out to be nothing still costs almost nothing.

How Can Training Cover Phone Lures?

Training and practice emails can include messages that ask for a phone call, not only ones with a link. That way staff rehearse the step that matters: hang up, then report. A person who has seen a call-us email in training has an easier time pausing when a real one lands.

CISA’s mitigations for network defenders include a plain one: “Implement a user training program and phishing exercises”. It also tells defenders to “Reinforce the appropriate user response to phishing and spearphishing emails.” A call-us email is one more case for that rehearsed response.

A filter and a trained team cover different ground. A filter can stop a lot of bad mail before anyone sees it. Practice covers what gets through, and a message with no link and no attachment is the kind that can get through.

O&O Systems’ Email Security and Spam Protection page says its team combines filtering, monitoring and user training, and that training and simulations reduce the risk of human error.

Frequently Asked Questions About Callback Phishing

Is callback phishing the same as vishing?

Not quite. Vishing is a scam phone call that reaches you. With a call-us email, the target places the call, which can make the call feel safer than it is. The rule doesn’t change: hang up, then check through a number you already have.

Why would a scam email have no link?

A phone number can give a filter less to flag than a link or an attachment. It also moves the conversation to a call, where the sender can answer questions and talk past doubts.

What if the email says we’ve already been charged?

Don’t call the number in that message. Check the card or the bank statement, or sign in to the vendor account directly. A real charge shows up there. If it doesn’t, nothing was lost by looking.

Can a caller do much without our passwords?

They may not need them. Once a remote access program is running, the caller may see and use whatever the signed-in employee can reach. That can include mail, files and anything already open on the screen.

What if someone already let a caller in?

End the session and disconnect that computer from the network. Then call IT. As a general rule, those are the first steps, and the people who run the network decide what follows.

Agree on the Rule Before the Email Arrives

A Florida office can write this rule on one page. Put the staff steps on it, name the approved remote access program, and name the person who hears about a suspicious message. Then a call-us email becomes a small event: somebody checks another way, and nobody dials the number in the message.

If your team has no written rule for callback phishing, ask O&O Systems about email security and staff training.