TOAD: when phishing asks you to pick up the phone

The email contains no link and no dangerous attachment. Just an invoice: “Renewal of your subscription: $399.99. Not you? Call our customer service.” No filter worries about it, and that is the whole point. This technique is called TOAD, for Telephone-Oriented Attack Delivery: an attack that goes through the phone. It is also known as callback phishing.

What is a TOAD attack?

Classic phishing wants us to click. TOAD wants us to call. The email is only the bait; the real trap is the conversation that follows, with a well-trained fake agent.

The technique became famous in 2021 through a campaign dubbed “BazarCall”: fake subscription invoices pushed recipients to call a call centre, where they were talked into installing malware while believing they were cancelling the subscription. Since then, variants have multiplied.

The typical scenario: an invoice we never asked for

The message looks like an order confirmation or an invoice: antivirus subscription, software, tech support service, online purchase. It has three ingredients:

• an amount that triggers a reaction, high enough to worry us;
• a way out: “Not you? Cancel within 24 hours”;
• a single contact option: a phone number.

On the other end of the line, the fake agent is friendly and reassuring. To “cancel” or “refund”, he asks us to install remote support software, then to log in to our online banking. What follows is classic: a “refund” that is too large by mistake and has to be “returned” by bank transfer; or spyware quietly installed during the operation.

Why the lack of a link makes detection harder

Email filters know how to visit links, analyse pages and inspect attachments. In a TOAD email, there is nothing to visit. The text is ordinary, the tone commercial, and for the robot the phone number is just a string of digits. To make the task even harder, scammers often put the invoice in an image or a PDF, write the number with spaces or unusual characters, and change numbers from one wave to the next.

Sometimes the email is even sent by a real online invoicing service: the scammer creates an account, writes a fake invoice and slips his number into the “note” field. The message leaves from the service's own servers and passes every authentication check, as the guide An email can lie… even when the checks say “OK” explains in detail.

The phone number: the centrepiece

In a TOAD attack, the number plays the role the link plays in classic phishing. It is what leads to the trap, so it is what we must examine. A few pointers:

• it is often an ordinary landline number or a number obtained online, which can ring anywhere in the world;
• it appears nowhere on the official website of the company named;
• it changes often: a single campaign can use dozens of them.

How to check the number and the impersonated company

The golden rule: we never use the number given in the message to check the message. That would be asking a suspect to confirm his own alibi.

1. We check at the source. We type the company's official website address ourselves, or open its app, and see whether the subscription or order really exists in our account.
2. We look the number up online. Other people have often reported it already. Careful: no results proves nothing, the number may be brand new.
3. We compare with the company's official contact details, found by our own means.
4. We keep one simple principle: no genuine customer service asks you to install remote access software to cancel a subscription, or to make a transfer to receive a refund.

To check the rest of the email (real sender, sending server), the guide Phishing: how scammers get their emails through shows where to look.

What can we report when there is no fraudulent site?

No site, but that doesn't mean nothing to report. Three targets remain useful:

• The server that sent the email. A TOAD message is still an email, sent by a machine that belongs to someone. We paste its full source into Baitback: the tool finds the sending server, its host and its abuse address, and prepares ready-to-send reports. If the email comes from a hijacked genuine invoicing service, we report the fraudulent account to that service: it can close it.
• The phone number. In France, for example, the 33700 service collects reports of unwanted text messages and calls, and the official reporting platform (PHAROS) also accepts scams. Every country has its own equivalent services: it is worth looking up yours.
• The impersonated company. Most major brands have an address dedicated to fraud attempts in their name. They can warn their customers and take legal action.

The limits of conventional reporting

Let's be honest: TOAD is harder to stop than a fake site. A domain can be suspended in a few hours by a registrar; a phone number obtained online, sometimes abroad, can be replaced in minutes, and there is no “abuse address directory” as simple as the one for servers. The sending server remains the easiest link to cut, which is why it is always worth reporting. And every number reported, even on its own, feeds the databases that allow carriers and call-filtering apps to display “suspected spam”.

If we have already called

If the conversation has taken place: we hang up, disconnect the computer from the internet, uninstall the remote access software, call our bank on its official number, and change our passwords from another device. In France, the Cybermalveillance.gouv.fr platform guides victims step by step; most countries have a similar victim support service.