Fake Invoices, Real Scammers: The Callback Phishing Playbook
Barracuda Networks, Friday, August 28th, 2026
Barracuda breaks down callback phishing, where fake invoices and calendar invites push victims to phone a live scammer.
Barracuda examines callback phishing, in which attackers use fake invoices, image-only emails and calendar invites to move victims from the inbox to a phone call with a live scammer.
The ultimate payload in these attacks is not a link or attachment but a phone number, which is why they slip past controls tuned to detect malicious URLs and files.
Attackers increasingly hide callback scams inside images, defeating text-based content analysis entirely. The post walks through how the attacks are constructed and how Barracuda detects them, including the signals that survive when the message body carries almost no parseable text.