SecurityRingBook a Demo

Glossary

What is callback phishing?

A lure, such as a fake invoice, renewal notice or security pop-up, that asks the victim to call a phone number, where the attacker takes over.

How it works

CISA notes that vishing can be combined with other social engineering that entices a victim to call a certain number and divulge sensitive information. When the first message carries only a phone number, there is no link for a filter or a reader to check.

A real example

The FBI’s September 2023 warning on “Phantom Hacker” scams describes a scammer posing as tech support who contacts the victim by call, text, email or pop-up and tells them to call a number for “assistance”. Once the victim calls, they are told to install remote-access software, and later callers pose as their bank and the government to move their money. The FBI recorded 19,000 tech-support-scam complaints between January and June 2023, with estimated losses over $542 million.

How to train for it

  • Do not call a number from an unexpected invoice, pop-up or message. Look it up yourself.
  • Never install remote-access software because a caller asked you to.
  • Report the message even if it had no link.

SecurityRing does not run callback (phone) simulations today; voice-call simulations are coming soon.

Sources

Every clause, incident and figure above comes from these official or original sources.

  1. FBI Internet Crime Complaint Center"Phantom Hacker" Scams Target Senior Citizens and Result in Victims Losing their Life Savings (PSA I-092923-PSA)Published 29 September 2023 · Accessed 17 October 2026.
  2. CISAAvoiding Social Engineering and Phishing AttacksAccessed 17 October 2026.