Pandora Renewal Scam: No Links, Just a Callback

The most dangerous thing in this Pandora renewal notice was the thing that was not there. No link. No attachment. No file to detonate. Just a plan that does not exist, a price of $51.72, and a phone number.

That phone number was the whole attack. An account executive on an insurance brokerage's client-service team received what looked like a Pandora Premium renewal invoice. Everything about it was engineered to make the recipient pick up the phone and call a stranger, which is the entire point of a callback scam.

This is a textbook TOAD attack. TOAD stands for telephone-oriented attack delivery, and it is the delivery half of vishing, or voice phishing, in which an attacker manipulates a victim over a live phone call. The email is only bait. Once the target dials the number, the fraud moves into a real-time conversation where no scanner can follow.

The sender was a college that has nothing to do with music

The display name read "Music Streaming" and the message impersonated Pandora. The actual sending address was admin[@]navsahyadri[.]edu[.]in, the mail domain of an Indian higher-education institution with no connection to audio streaming.

Attackers love this pattern because a legitimate .edu domain carries reputation that a freshly registered throwaway never will. The message was pushed out through Amazon SES, with an envelope and bounce domain of send.navsahyadri[.]edu[.]in and a sending IP of 54[.]240[.]9[.]33, then routed through a Mimecast gateway into the target's Microsoft 365 tenant.

Here is where the authentication story gets interesting.

SPF passed. DKIM failed. DMARC could not even answer.

SPF passed cleanly, because Amazon SES was authorized to send for that envelope sender. On its own, an SPF pass is exactly the kind of green checkmark that lulls a tired inbox rule into delivering a message.

But DKIM failed at Microsoft 365 with a body-hash-did-not-verify error. That specific failure means the message body was altered after it was cryptographically signed, which is consistent with a gateway inserting a banner into the message mid-flight. DKIM, the DomainKeys Identified Mail standard, exists precisely to detect this kind of tampering. When the body hash does not match, the signature is worthless.

Then DMARC returned a permerror. Not a pass, not a fail, a permanent error, because the sending domain published two conflicting DMARC TXT records. A domain is only supposed to have one. Two records is a misconfiguration that leaves DMARC unable to render any verdict at all, and attackers happily send from exactly these kinds of neglected, misconfigured domains.

So the auth chain told three different stories at once: one pass, one hard fail, and one error. Any single check read in isolation would mislead you. Read together, they scream.

The content did not survive a second look either

The body opened with a generic greeting and then fell apart under scrutiny. It billed the recipient for an "Audio Access" service tier. Pandora does not sell an Audio Access tier. Its real plans are Free, Plus, and Premium. The plan name was invented.

The invoice fields were fabricated: reference ID 79806ZC, an amount of $51.72, and an effective date rendered in day-first format as 18.01.2025. The footer credited "Pandora Music Ltd," which is the wrong legal entity for the brand.

And nowhere in the message was there a single hyperlink or attachment. The only call to action was a phone number: 321-394-9019. That is the signature move of a TOAD lure. The attacker wants zero digital evidence in the inbox and total control of the follow-up conversation.

Why traditional filters had nothing to grab

Most secure email gateways, or SEGs, are built to score two things above all else: the reputation of URLs and the behavior of attachments in a sandbox. This message contained neither. There was nothing to detonate, nothing to reputation-check, nothing to rewrite.

That gap is not theoretical. IRONSCALES platform data shows SEGs miss an average of 67.5 phishing emails per 100 mailboxes each month, and low-artifact lures like this one are a big reason why. When you strip out the link and the file, you strip out most of what a signature-based tool knows how to look at.

The tells that remained were all reasoning problems, not signatures. The wrong sending domain for the brand. The auth chain that contradicted itself. The invented product tier. The wrong legal entity. The phone-only call to action. Catching this requires a system that evaluates the message the way an experienced analyst would, weighing brand context and intent, not just scanning for known-bad strings.

That is where Themis, our Adaptive AI, works differently. It reasons over sender legitimacy, brand mismatch, authentication integrity, and the behavioral oddity of a billing email whose only action is a call. It flags the pattern of a vishing setup, an unexpected phone number standing in for the normal renewal flow, rather than waiting for a URL or payload that will never arrive. IRONSCALES protects more than 35,000 security professionals across 17,000+ organizations, and the volume of low-artifact callback lures we see confirms this technique is not an edge case.

See Your Risk: Calculate how many threats your SEG is missing

Indicators of Compromise

Mapping to MITRE ATT&CK

This attack maps to two techniques. The first is T1566 Phishing, the delivery of the fraudulent message itself. The second is T1656 Impersonation, the abuse of the Pandora brand to lend the invoice false legitimacy.

The threat data supports why this style works. The 2024 Verizon Data Breach Investigations Report found the human element present in 68% of breaches, and named pretexting, largely business email compromise, the top social-engineering incident type. Callback phishing is pretexting with a phone leg bolted on. The Microsoft Digital Defense Report 2024 similarly tracked attackers moving toward identity and social-engineering paths as technical exploits get harder. CISA's phishing guidance puts user-reported anomalies at the center of stopping the attack cycle early, which is exactly the layer that catches a lure carrying no scannable payload.

The takeaway: treat a phone number in a billing email as a payload

The defensive lesson is a mindset shift. In a callback attack, the phone number is the payload. Train your people to treat an unexpected phone number in any renewal or invoice email the same way they would treat a suspicious link, and to verify every renewal through the vendor's official account portal rather than the contact details inside the message. Then back that instinct with detection that reasons about content and authentication together, because when the link and the attachment are gone, reasoning is all you have left.