Your office manager gets an email from Staples. It says an iPad was ordered on your account for a few hundred dollars. Order number, delivery date, billing info, the normal Staples footer. Down in the shipping details there is a helpline number. She did not order an iPad. She calls the number.
That email came from [email protected]. It passed DKIM and DMARC, the two checks that are supposed to prove a message really came from the company it claims to be from. It was a real Staples notification. Cisco Talos tracked two of these campaigns, abusing the Staples and Dell order notification pipelines, totaling roughly 1,400 messages (Cisco Talos). This is callback phishing, and it is quietly one of the most effective things criminals are doing to small businesses right now.
How the attack actually works
Step one: the attacker does not build a fake Staples. They use the real one. Retailers, SaaS tools, survey platforms, payment processors and file-sharing services all send automated notification emails, and most of them let a user type free text into a field that ends up in that email. A name. A shipping note. A comment. Talos has seen this abused across more than 25 different legitimate platforms in the past year.
Step two: the attacker stuffs their payload into one of those fields. Not a link. Not an attachment. A phone number, formatted so it reads like a support line, sitting where the shipping address normally goes.
Step three: the platform sends the email. It is signed by the real company, from the real domain, through the real mail infrastructure. Your spam filter looks at it and sees a legitimate transactional message from a vendor you have done business with. Because that is exactly what it is.
Step four: the victim reads about a charge they did not make, sees a number, and calls. Now the attack moves off email entirely, where none of your security tools can see it.
Step five is where the money disappears. On the phone, the “support rep” is friendly and competent. They need to verify the order, so they ask the victim to install a remote support tool so they can “process the refund.” Or they walk the victim to a refund form that collects card and bank details. Or they ask for the code that just arrived by text, which is the multi-factor code for a real account. Every version ends with the attacker holding something they did not have ten minutes ago: a remote session on a work computer, bank credentials, or a live login.
Why your defenses miss this
Your email filter has nothing to flag. No malicious link, no attachment, no spoofed sender, no lookalike domain. SPF, DKIM and DMARC all pass honestly. The filter’s entire model of “bad email” assumes the bad part is a URL or a file. Here the bad part is ten digits of plain text.
Your MFA does not help. The victim reads the code out loud to a person they believe works at Staples. MFA stops someone guessing a password. It does nothing against a human being who asks nicely.
Your antivirus does not fire. The remote access tool the “rep” asks the victim to install is usually a real commercial product. It is signed, it is legitimate, and plenty of IT shops use it daily.
Your training probably does not cover it. Most phishing training is “do not click the link.” This attack’s entire design is to get past people who have learned not to click links. The instruction is to call, and calling feels like the safe, cautious thing to do.
That pattern of getting the user to take the dangerous action themselves is the whole trend right now. We covered a different flavor of it in an earlier post on fake CAPTCHA prompts, where the victim is talked into pasting a command into Windows. Same logic, different doorway.
What actually stops it
Make one rule the whole office knows: never call a number that came in an email. If a message says you were charged, go to the vendor’s site yourself, or call the number on your actual statement or card. This single rule kills the entire attack chain. It costs nothing. Put it in writing and say it out loud at a staff meeting.
Block consumer remote access tools on work machines. If AnyDesk, TeamViewer, or ScreenConnect are not tools your business uses, they should not be installable. Endpoint controls (what we configure for clients) can enforce that, and it turns the most damaging version of this scam into a dead end.
Give people a fast way to ask. Most of these calls happen because someone panicked alone at their desk. A Teams channel or a phone number where “is this real?” gets answered in two minutes prevents more fraud than any filter.
Know that the platforms are catching up, slowly. Microsoft starts rolling out AI phishing detection in Teams in early November, aimed at external first-contact chats, with general availability expected around mid-December (BleepingComputer). Useful. Not a substitute for the rule above, and it does not cover your inbox.
Watch the quiet channels. Your Microsoft 365 tenant should alert on new mail forwarding rules and unfamiliar sign-ins, because that is how you find out a call went badly before the wire transfer does.
If you are not sure how your team would handle that Staples email on a Tuesday afternoon, that is worth twenty minutes of thinking about. Book a free 15-minute consult and we will walk through it with you.