Zero Payload, One Phone Number: A Crypto Billing Callback

The email that reached a mailbox at an industrial engineering firm was a receipt for something nobody there had bought. It confirmed a cryptocurrency purchase of $574.80, laid out in the flat, slightly over-explained tone of an automated billing notice, and it closed with a customer support number to call if the charge was not recognized. There was no link to click. There was no attachment to open. There was no landing page, no redirect chain, no macro, no QR code, and nothing at all for a scanner to fetch, rewrite or detonate in a sandbox.

The entire payload was ten digits sitting in a paragraph of billing copy. And the message that carried it passed every authentication check an email security stack knows how to run.

A Receipt With No Purchase Behind It

The pretext works because of what it asks for, which is nothing. It does not request a password. It does not ask the reader to confirm an account or approve a transfer. It simply asserts that money has already moved, in an amount small enough to be plausible as a real charge but large enough to demand attention, and it offers a phone number as the remedy.

That inversion is the whole design. A credential-harvesting page has to persuade someone to type a password into a form they did not expect to see. A fabricated charge only has to make someone want their money back. The victim initiates the call, which means the victim arrives already motivated, already cooperative, and already convinced that the person on the other end works for a company that owes them a refund. Everything the attacker actually wants, remote access, card details, a wallet transfer, a one-time passcode read aloud, happens on the call. That is vishing with an email invitation, and it is why the pattern is usually shorthanded as telephone-oriented attack delivery.

There was one more quiet detail in the delivery. The target mailbox did not appear in the visible recipient headers at all. The message was blind-copied, which is a cheap way to push one template at many mailboxes at once while hiding the size and shape of the target list from every person who receives it.

Authentication Was Inherited, Not Bypassed

Here is the part that should change how a security team reads this case. The message was not spoofed. SPF passed, from an IP address inside Google's own sending infrastructure. DKIM passed, on a default Google Workspace signature belonging to the sending domain. DMARC came back as a best-guess pass, which is not the same thing as a policy evaluation: it is the marker a receiver applies when the sending domain publishes no DMARC record at all and the receiver infers a pass from the aligned SPF and DKIM results it already has. ARC passed, and Microsoft's composite authentication returned a pass. Every cryptographic and reputational control agreed that this message was exactly what it claimed to be, because in the narrow sense those controls measure, it was.

The sending domain belonged to a school in South America, registered nearly two decades earlier and used since then for ordinary institutional mail. Mail genuinely left an authorized path for that domain. What no header could express is that the domain's owner had no business relationship with an industrial engineering firm on another continent, no reason to send anyone a cryptocurrency billing notice, and almost certainly no knowledge that the message had been sent. The display name attached to the mail was a personal-sounding North American name with no discoverable tie to the institution, which points to a compromised or rented mailbox rather than header forgery. RFC 7489 describes DMARC as a domain alignment mechanism, and alignment is precisely what the receiving side found. Alignment is not intent.

This is the mechanic behind account takeover as a delivery service. An attacker who controls one real mailbox on an aged domain inherits its reputation, its clean sending history and its valid signatures, all for free. The 2023 FBI IC3 Internet Crime Report put reported business email compromise losses at roughly $2.9 billion, and the 2024 Verizon Data Breach Investigations Report found the human element present in 68 percent of breaches, with pretexting the leading social engineering type. Neither of those numbers is driven by clever malware. They are driven by trusted accounts saying untrustworthy things.

See Your Risk: Calculate how many threats your SEG is missing

Why A Zero Payload Beats A Clever One

Strip the technical surface away and count what a conventional gateway has left to work with. No URL to reputation-check or rewrite. No file hash to compare. No sender to fail on authentication. No lookalike domain to flag on registration age or edit distance. No embedded image to run through optical character recognition. Even a strict rule set has almost nothing to bite on, and a phone number is not an indicator most mail pipelines evaluate at all.

Both CISA phishing guidance and the NIST definition of phishing describe the threat in terms of deception and elicited action rather than in terms of attachments and links, which is the right framing for this case. The deception was complete and the requested action was a phone call. Detection has to live at the relationship layer or it does not exist.

That is where this one was caught. Themis, our Adaptive AI, scored the message as credential theft at 89 percent confidence and the incident was automatically resolved as phishing, entirely on behavioral evidence: a first-contact sender, an institutional education domain sending consumer financial content, a display name unmoored from its own domain, a hidden recipient path, and a financial assertion the recipient could immediately disprove from their own records. None of those signals require a payload to exist.

What To Take Into Monday

Treat authentication results as provenance, never as verdict. A message that passes SPF, DKIM, DMARC and ARC has proven where it came from and nothing more, and a compromised mailbox produces flawless results all day long. Then give your users one concrete rule for this exact pretext: never dial a number printed inside an unexpected billing notice. Look the vendor up independently, or check the account directly, because the moment a victim places that call the email controls stop mattering entirely.

Indicators of Compromise

MITRE ATT&CK Mapping