The Information Security team at 91ŃÇÉ« has received multiple reports from community members receiving fake “order confirmation” or “subscription renewal” emails that appear to be sent from legitimate companies like Staples, Microsoft, and Dell. The emails employ a new attack vector, targeting users via Telephone-Oriented Attack Delivery (TOAD).
This tactic is also known as callback phishing, where attackers send a legitimate-appearing order confirmation email that does not usually contain a phishing link, but rather tells recipients to call a toll-free number to cancel the order or dispute the fees charged.
Once a victim calls the number, they are connected to a fraudulent “customer support” representative who attempts to convince them to disclose sensitive information such as usernames, passwords, credit card or banking information. Attackers may also attempt to instruct victims to download remote access software on their device.
Attackers are shifting the interaction from the typical phishing email to a phone conversation in an attempt to bypass traditional email security controls that would otherwise be detected. Once connected via phone call, they will try to manipulate victims in real-time using urgency, fear, and social engineering techniques.
These scams usually try to impersonate well-known brands and services in attempt to instill a sense of legitimacy; examples include:
- Online orders from Dell, Staples, Amazon, or BestBuy
- Subscription renewals from Microsoft, Geek Squad, Norton, or McAfee
- Payment confirmations for products/services that you did not purchase
The warning signs are often the same: an unexpected order or invoice for a subscription you didn’t renew, a claim that you were charged for something you never purchased, pressure to act quickly, and instructions to call the phone number provided in order to resolve the issue and retrieve funds.
Some examples of these scam emails are shown below:
What to do if you receive this scam:
- Do not click links or open attachments in unexpected order confirmation emails.
- Do not call any phone number provided in the message. If you are concerned that a charge may be legitimate, check your bank statement and verify the charge with your financial institution and/or by contacting the company using their contact information listed on their official website.
- Verify the transaction independently. Log in directly to your account through the company's legitimate website or mobile app rather than using links in the email.
- Never provide passwords, multifactor authentication codes, banking details, or remote access to anyone in response to an unsolicited email or phone call.
- Report suspicious emails using the phishing report button or forward them to the Information Security team for review.
- If you already interacted with the message, clicked a link, entered credentials, or shared sensitive information over the phone, contact the Information Security team immediately.