Almost everything your staff have been taught about phishing involves a link or an attachment. Do not click it, do not open it, hover first and check where it goes. A campaign documented by Hornetsecurity, one of our email security partners, removes all of that. The message carries no link and no file. It tells the recipient that an expensive purchase has gone through, or that someone has just logged into their bank account, and it gives them a phone number to sort it out. Between 18 September and 2 October 2026, Hornetsecurity's Threat Intelligence Lab identified more than 150,000 of these messages and recorded over 40 different callback numbers.
An email designed to be safe to open
This style of attack is sometimes called a tech support scam, and the definition is broader than the name suggests. A fake support service persuades someone to call, and on that call convinces them to make a payment, give up information, or allow access to their device.
What makes it effective is that the email itself is harmless. There is no malicious attachment to detonate in a sandbox, no URL to compare against a blocklist, no payload at all. The dangerous part of the attack is a phone call that happens outside your network, on a device your security tools do not monitor, in a conversation nobody logs.
By the time anything measurable happens — a payment leaves an account, a code gets read out loud, remote access gets granted — the email that started it has usually been deleted.
What the messages claim
Hornetsecurity observed two main lures. The first is a purchase confirmation: an order has been approved, is being prepared, or has already been paid for. The items are deliberately expensive and deliberately ordinary — smartphones, gaming consoles, tablets, gift cards. The message appears to come from a retailer.
The second is a bank alert. Someone has signed in from a new device, sometimes from an unfamiliar location, and a transfer or payment of several thousand is now pending. The message appears to come from a bank.
Both end the same way. If you do not recognise this purchase, contact customer service. If you want to verify or dispute this transaction, contact support. The urgency does the work, and the number is right there.
The campaign Hornetsecurity tracked was aimed at French recipients, impersonating retailers including Darty, BUT and Cdiscount, and banks including Société Générale and Banque Populaire. Some messages did not bother with a real brand at all and simply used display names like "Customer Service", "Bank" or "Epay". None of that is specific to France. The template works with any retailer your staff shop at and any bank they use, and swapping the names is the easiest part of running it.
What happens on the call
The operators are prepared. Hornetsecurity describes a consistent script: the caller is asked for their name, which gets associated with the number they are calling from, then for the transaction reference in the message. The operator repeats details back — the amount, the merchant, the supposed beneficiary — which is exactly what a real support agent pulling up your file would do, and exactly what convinces the caller that they have reached the right place.
In the cases Hornetsecurity observed, operators also sent a file to the caller by MMS. The researchers were not able to retrieve it, so what it contained and what role it played are genuinely unknown rather than quietly assumed.
The assessed motive is financial. That could mean a direct payment, banking details, an authentication code read out during the call, or an action that hands over access to the device. Which one it is probably depends on how the call goes.
The callback numbers were linked to Onoff, a disposable number service. Hornetsecurity is careful to call this a correlation lead rather than attribution — it does not identify who is behind the campaign. The lab filed takedown requests, which Onoff acted on promptly, though repeated attempts to reach their anti-fraud team went unanswered.
Why this gets past defences that stop ordinary phishing
Filters are good at the things this campaign does not do. With no link and no attachment, the usual signals are missing, and a short message about an order is not obviously different from the real order confirmations arriving all day.
The sender does not help much either. Hornetsecurity makes the point plainly: a familiar institution name does not authenticate the sender. A display name reading "Société Générale" or "Customer Service" costs an attacker nothing, and across this campaign the sending addresses varied from message to message while the callback numbers stayed comparatively stable.
Awareness training has a gap here too. Staff trained to scrutinise links are being handed a message with no link, which can read as reassurance rather than warning. And the instinct the email exploits — somebody has spent my money, I need to stop this now — is a reasonable instinct. The attacker is not asking the victim to do something careless. They are asking them to do something responsible, through a channel the attacker controls.
What to tell your team this week
One rule covers most of it: never use the contact details in the message. If an email says money has moved, the way to check is to open your banking app directly, or to phone the number printed on the back of your card or published on the organization's real website. The message is allowed to tell you something might be wrong. It is not allowed to tell you who to call about it.
Make it specific rather than abstract. Staff should expect fake confirmations for things they never bought, and alerts about sign-ins they never made, and should treat the phone number in such a message as the suspicious part — the same way they would treat an unexpected attachment.
It is worth saying out loud that an urgent request does not become safe because it arrived by phone. Anyone can read a transaction reference back to you. Nobody legitimate needs an authentication code, and nobody legitimate needs remote access to your laptop to reverse a charge.
For whoever handles your email security, Hornetsecurity's own detection advice is useful: look for the combination of an unusual transaction, a high amount and an instruction to call back. Then normalize the phone numbers found in messages by stripping spaces, hyphens and brackets, and correlate them against message wording, display names and impersonated brands. Because the sending addresses change while the numbers recur, the number is often the thread that ties otherwise unrelated-looking messages into a single campaign.
And give people somewhere to take it. Most of these attacks end the moment the recipient asks a second person whether the email looks right. That only happens if asking is quick, normal and never treated as a waste of anyone's time.
