Glossary
What is callback phishing?
Callback phishing is a hybrid attack in which a message, usually an email about an unexpected charge, subscription or invoice, urges the recipient to phone a number.
- Also known as
- Telephone-oriented attack delivery (TOAD), hybrid phishing
- Channel
- Email or SMS, then a phone call
- Typical goal
- Payment, data or remote access to a device
- Related term
- Vishing
How it works
The email starts it.
The call finishes it.
- 01
Alarm
An email or text confirms a charge, renewal or order you don’t recognise.
- 02
Invite a call
It gives a phone number to “cancel” or “dispute” it, with no link for filters to catch.
- 03
Take control
A friendly agent asks for details, a payment to “refund” you, or to install a remote-support tool.
- 04
Exploit
With access or payment, the attacker steals money or data, or plants malware.
How to spot it
Never call the number
in the message.
Callback phishing turns your own caution against you: you phone to fix a problem, and the attacker answers.
Warning signs
- Unexpected invoice, renewal or order
- Asks you to call rather than click
- Agent wants remote access to your device
- Agent asks for card details to “refund” you
- Pressure to stay on the line and act now
Hang up, verify independently, then report.
Questions buyers ask
Frequently asked questions.
Why do callback phishing emails have no links?
Leaving out links helps the message pass email filters and makes it look like a routine receipt. The attack happens on the phone call instead.
What is TOAD in cybersecurity?
TOAD stands for telephone-oriented attack delivery. It describes attacks, such as callback phishing, that use a message to push the victim onto a phone call.
What should I do if I already called the number?
End the call, don’t install anything or pay, and report it to your security team through your organisation’s process. If you gave remote access, disconnect the device from the network and tell them immediately.
Let’s connect the dots
See the human risk.
Change what happens next.
Bring your awareness program, your reporting workflow, or the question your current metrics cannot answer.
Book a demo