The Amazon Order That Wanted You to Call, Not Click

An employee at a US retailer opened an Amazon order confirmation for an Apple iPhone 17 charged at $975.00, delivery by Monday, payment method "Online." She had not bought an iPhone. The email anticipated exactly that reaction: "If you haven't placed this order call immediately to block this transaction." Below the panic line sat two phone numbers and nothing else worth clicking.

That is the whole design. This was not an attempt to steal a password through a fake login page or to drop malware in an attachment. It was a telephone-oriented attack delivery scheme, better known as a callback phish or TOAD, and its entire purpose was to move the victim off email and onto a phone call where no email security control can follow.

The fake charge is the weapon

Every element of the body was tuned to manufacture urgency without leaving anything for a scanner to bite on. A recognizable brand, Amazon, complete with the logo. An implausible but alarming purchase, a nearly $1,000 phone. A tight delivery window ("Monday") to compress the victim's decision time. And an order number, TR3D52019, that looks specific enough to feel real. The message even personalized the greeting with the recipient's own email address to sell the impression that Amazon already had her on file.

There was no attachment. There was no credential-harvesting form. The payload was a phone call, and it was presented twice: "Customer Service - 810 261 5587" and "Customer Service - 828 579 2059." Neither number belongs to Amazon. When a victim dials, a live operator is waiting to walk them through "cancelling" the charge, a process that inevitably requires reading out a card number, granting remote access, or installing a "refund" tool. The attack succeeds entirely on the call, in a channel that your email gateway, your link scanner, and your attachment sandbox cannot observe.

The Verizon 2026 Data Breach Investigations Report (2026 DBIR) puts the gateway attack mix at roughly 80 percent plain phishing, 10 percent malware-laden, 5 percent callback or TOAD, and 3 percent BEC. That 5 percent is easy to dismiss until you notice it is the slice designed specifically to route around every technical defense you have invested in. Callback fraud does not fail your filters. It bypasses the premise that the attack lives in the email at all. This is the same logic that powers vishing, where the voice conversation, not the message, carries the theft.

Authentication passed. Alignment did not.

The delivery path is where this case gets instructive. The message was relayed through SendGrid, a legitimate email service provider, and it authenticated cleanly against that infrastructure: SPF passed for sendgrid.net, and DKIM verified a valid signature for sendgrid.net. A checkbox-style "did auth pass?" filter would see two green lights and wave it through.

But the visible From address was a consumer Gmail address (display name "David"), and that is where the story falls apart. DMARC evaluates whether the From domain aligns with the domain that actually authenticated the message. Gmail never authorized this send. The Authentication-Results header recorded it plainly: dmarc=fail action=none header.from=gmail.com, with a compauth=softpass and a spam confidence level of 5. Microsoft's own filtering routed the message to Junk but did not block it, which is the recurring gap with a soft signal: filtered is not the same as stopped, and a determined recipient will still open a message sitting in their junk folder.

The lesson is one security teams relearn constantly. Authentication passing for the relay tells you the mail was sent through legitimate plumbing. It says nothing about whether the sender identity is honest. Attackers have figured out that borrowing a reputable ESP's authenticated infrastructure is cheaper and more reliable than standing up their own.

A link that leads nowhere a scanner can read

Both "Customer Service" numbers were wrapped as hyperlinks pointing not to amazon.com but to a SendGrid click-tracking host, u59814787.ct.sendgrid[.]net. The tracking parameter encodes the final destination and hides it from the recipient and from inline scanners alike. When our analysis attempted to resolve the wrapped URL, it returned a 400 error with no observable landing page, meaning the destination was ephemeral, gated, or already torn down.

This is deliberate. Hiding a destination behind a reputable tracker's click-through strips a scanner of the one thing it needs to render a verdict: a final URL to judge. The link is not the point, but it still does useful work for the attacker by frustrating the tools that expect a clean destination to evaluate. It maps to MITRE ATT&CK T1566.002, phishing via link, layered on top of T1656, impersonation, and T1036.005, masquerading as a trusted service.

See Your Risk: Calculate how many threats your SEG is missing

Detecting an attack with no payload to scan

If there is no malicious link destination and no attachment, what is there to catch? This is precisely where signature-based and sandbox-based tooling runs out of road, and where behavioral analysis earns its keep. Our Adaptive AI, Themis, does not need a bad file to make a decision. It scored the message on the pattern: a first-time sender, a consumer Gmail From that failed DMARC, Amazon brand impersonation with no corresponding Amazon infrastructure, click-tracked links concealing their target, and classic urgency phrasing engineered to trigger a call. Themis reached 90 percent confidence and the message was automatically quarantined within about two seconds of arrival, before the recipient had a realistic window to dial either number.

For defenders, the takeaways are concrete. Treat "call this number to fix an urgent problem" as a threat pattern in its own right, independent of any link or file. Do not let SPF and DKIM passes stand in for trust when DMARC alignment fails. And recognize that consumer brand impersonation now lands in corporate inboxes routinely, because the DBIR and the FBI IC3 2024 report both confirm that callback and impersonation fraud produce some of the highest per-incident losses precisely because they exploit human trust rather than software flaws. CISA's phishing guidance makes the same point: the durable control is interrupting the attack cycle early, not hoping a scanner flags a payload that was never in the email to begin with. Across the more than 1,921 organizations IRONSCALES has analyzed, SEGs miss roughly 67.5 phishing emails per 100 mailboxes every month, and the ones that slip through are increasingly the ones with nothing for a gateway to scan.

Indicators of Compromise

See You Next Time

Callback fraud will keep winning small until security teams stop treating the phone number as harmless text. The email is just the doorway. The theft happens on the line.