What is Callback Phishing? How to fight it?

Callback Phishing attacks are on the rise. If you've ever received an email asking you to renew your service or pay a bill for a service you never purchased, you've encountered Callback Phishing.

What is Callback Phishing?

A Callback Phishing attack, sometimes referred to as a telephone directed attack distribution (TOAD), combines two phishing methods. Victims receive a phishing email alerting them to a problem. Instead of providing more information about the situation in the email, the bully includes a contact number, hoping the victim will call back.

When the recipient calls the phone number in question, the threater will use social engineering techniques to lure the victim into sharing sensitive data, installing malware, or performing any other action that may be harmful to the victim. can benefit the threater.

How does Callback Phishing work?

First, the victim receives an email informing them that they must pay a fee to sign up for a service. Usually, there is no invoice attached to the letter. The victim then becomes curious or angry when they receive a request to pay for a service they didn't buy in the first place - so they call the phone number mentioned in the email.

The bully takes the call and tricks the victim into following specific steps to cancel the service. When the victim follows those steps, malware will be installed on their PC or the threat agent will receive sensitive information.

The bully ends the call after the victim takes the action they want.

Why Do Hackers Try to Perform Callback Phishing Attacks?

What is Callback Phishing? How to fight it? Picture 1

By performing a successful Callback Phishing attack, an attacker can:

1. Steal sensitive data, login credentials or any other type of confidential data.
2. Install ransomware on the victim's machine to encrypt data for ransom.
3. Get the victim's credit card or bank account information to steal money.
4. Install remote access software on victim's computer to steal sensitive files.

The purpose of these attacks is to steal data, money, or both.

Today, most individuals and companies use anti-phishing or anti-spam solutions to block emails containing malicious files.

However, the Callback Phishing email does not include malicious attachments or links. So these emails tend to bypass email filters and get delivered to the victim's computer. In addition, Callback Phishing attacks have a low cost per target.

So it's no surprise that more and more threat actors are making Callback Phishing attempts.

How to prevent Callback Phishing attacks

What is Callback Phishing? How to fight it? Picture 2

A successful Callback Phishing campaign can cause irreparable damage to individuals or companies.

Here are some ways to protect against Callback Phishing attacks.

Implement an email security solution

While some carefully crafted Callback Phishing emails can slip through email security solutions, implementing a reputable email security solution like an email gateway can help improve a company's security posture.

The attack can cost you a large amount of money, as well as reputation. Deploying a robust email security solution can reduce the risk of attack. In most cases, an email security solution will detect and block phishing, phishing, and phishing emails. Such a solution can also help prevent malware from being installed on the PC.

Furthermore, a good email security solution can alert you to suspicious user behavior. So make sure you have one of the top email toolkits for configuring a secure inbox.

Even if you don't work in a professional environment, having a good anti-virus software installed on your device can give you ultimate security from phishing emails and many other cybersecurity threats. .

Double-check your email for signs of scams

While Callback Phishing emails don't have malicious attachments or links, they do have some obvious signs of phishing that you should watch out for.

An email has the potential to be phishing when it has an unusual sender. For example, an email could claim to be from a legitimate company, but without the corresponding brand email address. Instead, it has a generic email address like google.com or yahoo.com.

You can also be suspicious of emails with spelling and grammatical errors. No legitimate company sends emails full of text errors. Also, look out for messages that provide a short window of time to perform a task. For example, email only gives you a few hours to pay to keep your subscription active.

Phishing emails may be flagged by your email service provider. Some email service providers have built-in anti-spam technology to warn users about phishing and spam emails.

Now, threat actors combine various social engineering tactics to trick victims into calling them. Therefore, you should be very careful when taking actions based on suspicious emails.

Be careful with money things

One surefire way to avoid falling victim to Callback Phishing is to double check that the message is related to money or credentials.

If any email from a legitimate-looking company creates a sense of urgency and asks you to send money, question it.

In case the email has no details except for the phone number of a customer service representative, it is most likely part of a Callback Phishing campaign.

Organize anti-scam training programs

Callback Phishing, part of social engineering attacks, relies on human errors rather than system flaws.

Thus, running regular employee cybersecurity awareness training programs can reduce the risk of Callback Phishing attacks.

Here are the key areas you should focus on when building your security awareness training program. For starters, the security awareness training program will provide knowledge about various cyber security attacks, including Callback Phishing, spam, malware, social engineering methods. , script-based attacks, etc. Full focus is needed on how to detect phishing emails, malicious URLs, fake websites, etc.

Employees may not use corporate email addresses to download questionable technology tools or sign up for random online services. Doing so is a way of paving the way for phishing or spam emails. You should ensure that your employees follow best password security policies. They should also use multi-factor authentication to add an extra layer of security to their accounts.

Your training program should also include phishing tests to assess employees' readiness to combat Callback Phishing campaigns. And make sure your employees follow best practices for protecting company email accounts to avoid phishing.

David Pac

Update 22 February 2023