How to Spot Callback Phishing and TOAD Scams (2026)

Callback phishing — also called TOAD (telephone-oriented attack delivery) — is an email that skips the malicious link entirely and pushes the recipient to call a phone number, where a live attacker walks them into installing remote-access software or handing over account details. The single tell that gives it away: the message has no link and no attachment, just an invoice-style layout, manufactured urgency, and a number to dial. Standard email filters scan for malicious URLs and attachments — a TOAD email has neither, which is exactly why this format keeps landing in inboxes clean in 2026.

TL;DR

• Callback phishing (TOAD) scams skip the link entirely — a phone number is the only payload, which is why filters miss it.
• Fake subscription renewal invoices from Norton, McAfee, or Geek Squad are the most reused TOAD lure heading into 2026.
• The tell on the call: a request to install AnyDesk, TeamViewer, or ScreenConnect means hang up immediately.
• Standard secure email gateways can't flag TOAD emails because there's no malicious URL or attachment to scan.
• DefendWise trains employees to recognize callback phishing lures before they ever pick up the phone.

Why this matters

TOAD attacks target the gap between email security and phone security. Secure email gateways, link scanners, and attachment sandboxes catch the phishing techniques they were built for — weaponized macros, credential-harvesting pages, malicious URLs. None of that machinery fires on a callback phishing email because there's nothing to detect. The payload is a phone number and a human being on the other end of it, and no software layer sits between an employee and that call.

That's also why TOAD pairs so well with vishing tactics — the email is just the pretext that gets someone to dial. Once they're on the phone, the attacker controls the pace, the story, and the next step, which is almost always a request to install remote-access software. For MSPs running compliance-driven training programs in 2026, TOAD is the clearest proof yet that email-only phishing simulations leave a real gap: an employee can pass every simulated-link test and still dial a scammer's number without hesitation.

How to spot callback phishing and TOAD scam emails

Five checks catch almost every TOAD email before anyone picks up the phone:

1. No link, no attachment. If the only way to "resolve" the issue is a phone number, treat that as the red flag, not a convenience.
2. Invoice or renewal formatting for something you don't recognize. Norton, McAfee, Geek Squad, and PayPal renewal notices are the most reused templates because almost everyone has heard of those brands.
3. Sender domain doesn't match the vendor. A generic domain, a lookalike domain, or a free personal email address sending a "corporate invoice" is a mismatch worth checking before anything else.
4. Manufactured urgency. Lines like "your card will be charged today" or "unauthorized renewal detected" are written to make you call instead of think.
5. A request to install software once you're on the phone. This is the moment that confirms the attack — legitimate billing departments never ask you to install remote-access tools to fix an invoice.

Here's how a real renewal notice compares to a callback phishing attempt:

Signal	Legitimate renewal notice	Callback phishing (TOAD) email
Self-service link	Present, points to the vendor's real account portal	Absent — the phone number is the only option offered
Sender domain	Matches the vendor's actual domain	Generic, altered, or unrelated to the vendor
Urgency language	Minimal or none	Heavy — "unauthorized charge," "expires today"
What happens on the call	Standard support, no software install required	Push to install AnyDesk, TeamViewer, or ScreenConnect

Verdict: any email that swaps a link for a phone number and pairs it with urgency is TOAD until proven otherwise.

Common TOAD lures MSP clients report

• Fake antivirus or subscription renewals — Norton, McAfee, and similar brands get reused because almost every employee assumes a real subscription exists somewhere, even if they can't remember buying it.
• Fake tech support or Geek Squad invoices — framed as a purchase confirmation for a service the recipient never bought, which drives panic and a fast callback.
• Fake bank fraud alerts — "unauthorized transaction detected" messaging that never names the target's actual bank, betting on a coincidence match with whatever card the reader carries.
• Fake IT helpdesk tickets — internal-looking notices claiming a license renewal or software update failed, timed to catch employees off guard at a company that actually uses that software.
• BazarCall-style campaigns — the named campaign that popularized this delivery model, tying callback phishing to remote-access installs that access-broker networks later resell to other criminal groups.

Fake DocuSign signature requests and fake calendar invites use a related bait-and-pretext model, but they push toward a link instead of a phone call — a different delivery channel with the same goal of skipping past scrutiny.

Why callback phishing works

• Filters aren't built for it. Secure email gateways scan for malicious links and attachments — a TOAD email has neither, so it passes every automated check clean.
• A live voice feels more trustworthy than a link. Years of phishing awareness training tell employees to distrust links; almost none of that training covers distrusting phone numbers.
• Remote-access tools are legitimate software. AnyDesk, TeamViewer, and ScreenConnect are tools IT teams actually use, so an install request doesn't trigger the same alarm a suspicious .exe attachment would.
• Urgency plus authority shortcuts scrutiny. A billing-department or IT-helpdesk tone pushes people to act fast instead of verifying first, which is the entire point of the pretext.
• The attack is industrialized. BazarCall-style operations run call centers dedicated to this exact script, so the person answering the phone is practiced, not improvising.
• Training gaps. Most phishing simulation programs test link clicks and attachment opens — few test whether an employee will dial a number and follow instructions once a stranger answers, which is a gap covered in DefendWise's anti-phishing software for MSPs guide.

Related questions about callback phishing and TOAD scams

Is TOAD the same as vishing?

No — TOAD is the email that creates the pretext, and vishing is the phone conversation that follows once the target dials. TOAD sets up a believable, written reason to call; vishing techniques like impersonation, authority, and urgency take over for the rest of the attack once someone answers.

What is BazarCall and is it still active?

BazarCall is the campaign that popularized the callback-phishing format, using fake subscription invoices to route victims toward remote-access installs. Variants of the same delivery model — different invoice brands, same script, same phone-call handoff — are still circulating in 2026.

Can spam filters or antivirus software catch TOAD emails?

No — most secure email gateways look for malicious links or attachments, and a TOAD email has neither, so it reaches the inbox looking like a routine invoice. Catching a callback phishing attempt depends on the employee reading it carefully, not on the filter scanning it.

Train employees to spot callback phishing

Flat-fee security awareness training MSPs deploy with DefendWise across every subclient.

See how it works

FAQ

What does TOAD stand for in phishing?

TOAD stands for telephone-oriented attack delivery — an email or message that pushes the target toward a phone call instead of a malicious link. The email itself carries no payload; the phone call is where the actual attack happens.

How do I know if a subscription renewal email is fake?

No link to manage the subscription and a phone number as the only way to respond are the two biggest tells of a fake renewal email. Genuine renewal notices from real vendors almost always include a self-service account link alongside any phone option.

What happens if I call the number in a TOAD email?

A live agent, posing as billing or IT support, walks you through installing remote-access software or reading off account details over the phone. If you've already called and installed anything, disconnect the device from the network and report it immediately.

Is callback phishing the same as vishing?

No — callback phishing (TOAD) is the written email that creates the reason to call, while vishing is the phone-based social engineering that happens once the call connects. TOAD is the setup; vishing is the follow-through.

What should employees do if they already called a TOAD number?

Hang up immediately, don't install anything the caller requests, and report the call to IT the same way they'd report a suspicious email. Speed matters more than embarrassment — a fast report limits how far an attacker gets.

Which remote-access tools do TOAD scammers ask victims to install?

AnyDesk, TeamViewer, and ScreenConnect are the tools most commonly requested because they're legitimate software IT teams actually use. That legitimacy is exactly why the request doesn't feel alarming to an untrained employee.

Can security awareness training reduce callback phishing risk?

Yes — training that includes phone-based social engineering scenarios, the kind DefendWise builds into its simulation library, is what catches TOAD attempts before an employee dials. Link-only phishing tests don't cover this attack path at all.

Do TOAD emails ever include a malicious link too?

Rarely — the entire point of TOAD is to bypass link and attachment scanners, so most versions contain zero links. When one does appear, it's usually decorative rather than the actual attack vector.

One last thing

The scariest part of TOAD isn't the call itself — it's what happens after. BazarCall-linked operations built their business model around reselling remote-access footholds to ransomware access brokers, so a single successful callback in 2026 can sit quiet for weeks before it turns into a full encryption event. The email is the cheap part of the attack; the phone call is where the real damage gets set up, and that's the part no link scanner will ever catch. Programs like DefendWise pair phishing simulations with this kind of phone-based scenario training so MSPs can show clients real coverage, not just link-click statistics.

Related guides

• Training employees to spot fake software update scams
• Reporting a phishing email to your IT team
• Building a phishing incident response plan