Guide · Phishing & fraud
Fake invoice? Don’t call the number
Affiliate disclosure: This page contains affiliate links, which are labeled. If you buy through one, Small Biz Cyber Guide may earn a commission at no extra cost to you. Recommendations are not for sale. See the full affiliate disclosure.
The email looks like a receipt: a $499 antivirus renewal, a PayPal payment, a Geek Squad subscription. There is no link to click and no attachment to open, just a phone number to call “if this wasn’t you.” That number is the whole trick. The scam happens on the call, where a live person talks your bookkeeper or office manager into remote access, card details, or a “refund” that ends with your money leaving.
Security teams call this callback phishing, or TOAD (telephone-oriented attack delivery). It slips past spam filters because there is often nothing malicious in the email for a filter to catch, as Malwarebytes researchers point out. This guide is the companion to our Short on fake-invoice callbacks.
Recent breach of this type: A Virginia business lost $856,000 after a fake bank caller collected its 2FA codes (disclosed ). A caller posing as the bank talked an employee into reading out 2FA codes, and wires went out. What happened and what to do →
Quick verdict
- Never call a phone number from an invoice, receipt, or pop-up you did not expect. Check the charge by logging in yourself or by calling a number you already have on file.
- No unexpected caller gets remote access. The FTC is blunt about it: legitimate tech companies won’t contact you to say there’s a problem with your computer, and real security pop-ups never ask you to call a number.
- Write the bill-paying rule down. An invoice gets paid only if it matches a vendor you actually use, a purchase someone approved, and the amount you expected. That is the FTC’s advice to small businesses on fake invoices.
Team rule: If an invoice, receipt, or pop-up you didn’t expect gives you a number to call, don’t call it. Log in to the account yourself or use the number you already have. Nobody gets remote access to a work computer unless our named IT contact set it up.
How the callback scam works
| Stage | What you see | What the scammer wants |
|---|---|---|
| The bait | A receipt, renewal, or “past due” notice from a familiar brand (Geek Squad, PayPal, Norton, Amazon) with a support number | Panic about a charge you don’t recognize |
| The call | A friendly “billing agent” with a polished script and a deadline (“cancel within 24 hours”) | Your trust, and no time to think |
| The ask | “Install this so I can process your refund,” or “read me the code we just sent” | Remote access to your PC, then your bank, payroll, or email |
| The twist | “Oops, we refunded too much. Please send back the difference.” | A wire, gift cards, or crypto that can’t be reversed |
Remote-access tools are central to this. CISA documented attackers who used fake subscription-renewal emails to get victims to call and install legitimate remote management software, then used that access to run refund scams against the victims’ bank accounts. Real remote tools don’t set off alarms, which is why the rule has to come from people, not just software.
The verify-it-yourself routine (two minutes)
- Don’t call, reply, or click. Just receiving the email doesn’t hurt you. Calling the number is the step that does.
- Check the account directly. Type the vendor’s address yourself or open its app, and look at billing history and active subscriptions.
- Check your bank or card statement. No pending or posted charge means there is nothing to cancel.
- Still unsure? Call the real vendor using the number on its official website, a past genuine invoice, or the back of your card. Never use the number in the message.
- Report and delete. Forward phishing emails to
[email protected]and report the scam at ReportFraud.ftc.gov, as the FTC recommends.
Paper invoices count too. The FTC warns about fake invoices that arrive by mail for tech support, domain registration, or SEO services you never ordered, sometimes stamped “past due.”
Remote access rules for the whole team
- Name your IT contact. Write down who actually supports your computers (your managed IT provider or one named person). Anyone else asking for remote access gets a no.
- Staff never install remote tools for a caller. That covers AnyDesk, TeamViewer, ScreenConnect, Quick Assist, or any “support app” a stranger walks you through.
- Use standard user accounts for daily work. If the person at the keyboard can’t install software without an admin password, a caller can’t talk them into it as easily.
- Run endpoint protection on every PC. It won’t stop someone from handing over access, but it helps you spot and clean up what gets installed afterward. See our endpoint protection guide.
Backstop: protect every computer
Callback scams end with software on a work PC. Our endpoint protection guide compares Microsoft Defender for Business, Bitdefender, ESET, and ThreatDown for small teams and includes a 30-day rollout.
If someone already called
- Hang up and disconnect. Turn off Wi-Fi or unplug the network cable so any remote session ends.
- Remove what they installed, then scan. Uninstall any remote tool from the call and run a full scan with your security software. Call your IT contact if you have one.
- Call your bank using the number on your card or statement. Dispute card charges and ask about stopping or recalling any transfer.
- Change passwords from a different, clean device. Start with email, banking, and anything typed during the call, and turn on MFA. Our MFA for Microsoft 365 guide covers email.
- If you gave out personal details like a Social Security number or date of birth, freeze your credit at all three bureaus. It’s free. Our identity theft protection guide walks through it.
- Report it at ReportFraud.ftc.gov, and if money was lost, also file with the FBI at ic3.gov.
If the caller got personal details: Coveron
Freeze your credit first, because it’s free and it works. If you want ongoing monitoring and restoration help on top of that, Coveron is the paid identity protection service we cover in our owner identity guide.
Bottom line
The invoice is the bait. The phone call is the trap. Check every surprise charge through a channel you already trust, and make “no remote access for unexpected callers” a rule everyone in the office knows by heart.
Prefer video? Watch the under-a-minute version on YouTube: Fake Invoice? Don't Call the Number (Callback Phishing).
Free next step: Get the Small Business Cybersecurity Checklist — download it now, or sign up there to get it by email and hear about new guides.
Put the rule on every desk. The Small Business Security Essentials Toolkit ($79) includes an “Is this payment request real?” decision tree, a Before Money Moves desk card, and the Acceptable Use rule that says never call a number from an unexpected invoice.