The order confirmation that's real — and the phone number that isn't

An email arrives from a name-brand retailer confirming an order you never placed. Your spam filter clears it. Your email security software clears it. The email genuinely comes from that company. The only problem is the "helpline" number buried in the order details — which routes straight to a scammer waiting to take your call.

An attack your email security cannot catch

Most phishing emails can be stopped because something is off: the sender's domain is wrong, the authentication signatures don't check out, or the content triggers a filter. This attack removes all of those signals.

Cisco Talos researchers documented this technique — which they call "platform-as-a-proxy" — being used across more than 25 legitimate online platforms, including major retailers, payment processors, collaboration tools, and AI services. The method is straightforward: an attacker creates a real account or transaction on a platform and types their own phone number into a user-controlled field — a billing note, a shipping instruction, or an order comment line. The platform then sends an automated order confirmation to the target's email address, and that confirmation contains the attacker's number, presented as a "helpline" or support contact.

Because the email genuinely originates from the legitimate platform, it passes the authentication checks — DKIM and DMARC — that email security tools rely on. Cisco Talos observed roughly 1,400 messages across just two campaigns targeting customers of Dell and Staples. More than 25 platforms have now been identified as weaponized this way.

Churches, nonprofits, and small-business offices are natural targets. Finance staff and administrators routinely receive vendor order confirmations, software renewal notices, and supply emails. An unexpected confirmation from a familiar name-brand company looks routine — not alarming.

What happens when someone calls

This class of attack goes by the name TOAD — Telephone-Oriented Attack Delivery. The email is not the scam itself; it is a delivery mechanism designed to get someone on the phone. Once the call happens, the attacker controls the conversation.

The script is almost always the same. The scammer answers as a friendly customer service representative and offers to help "cancel" the unauthorized order. During that call, they try to accomplish one or more of the following:

• Collect payment information to "process the refund" — a card number or bank account to send the money back to.
• Gain remote access to a computer — walking the caller through downloading a remote-control tool so they can "verify the account" or "process the cancellation" from their side.
• Harvest account credentials — asking the caller to log in while the scammer watches, or to read out a one-time code "so we can confirm your identity."

Cisco Talos research on this class of attack found the most commonly impersonated brands include Microsoft, Norton LifeLock, PayPal, DocuSign, and Best Buy's Geek Squad — alongside major retailers. The brands change; the call script does not.

What to do

1. Do not call the number in any unexpected order confirmation, even from a brand you recognize. Find the vendor's real support number independently — type the company name into your browser, navigate to their official site, and use the number listed there.
2. Before acting on any unexpected order, ask who placed it. A 30-second check with the person who would have made the purchase stops this scam immediately. In a small church or nonprofit office, that is usually a one-person conversation.
3. Log in directly to your account — never through a link or number in the email. If a notification mentions a Microsoft subscription, PayPal charge, or Norton renewal you don't recognize, open a browser, type the company's address, log in that way, and check your recent activity from there.
4. Never give a caller remote access to your computer to resolve a billing problem. Legitimate vendors do not need to see your screen to cancel an order. If a caller requests remote access, end the call.
5. Set a standing rule for your finance staff: any unexpected vendor confirmation over a set dollar amount is verified with the buyer before any call is made. A brief policy conversation this week prevents an expensive mistake next month.
6. Forward unusual vendor emails before acting on them. Send the message to your IT contact, or to security@familysentinel.org for a free verdict — two minutes of review can stop a costly call.

Related reading

• How to preserve and report a suspicious vendor email — what to save and where to send it before anyone makes a call or takes action.
• The payment and invoice verification checklist for churches and small offices — the callback verification protocol that stops both wire fraud and this class of phone scam.
• Email security checklist for small organizations — the settings and policies that reduce exposure to vendor impersonation and authenticated-email attacks.

Written by the Family Sentinel security desk — a working Security Architect and the team who watch organizational inboxes around the clock. Sources: Cisco Talos Intelligence Group, "The Trojan horse of cybercrime: Weaponizing SaaS notification pipelines" (2026); Cisco Talos research on transactional email abuse, reported October 2026 via GBHackers and Cyberpress (Dell and Staples campaigns, 25+ platforms, approximately 1,400 observed messages); TOAD/callback phishing research, Cisco Talos and Dark Reading, 2026. Have a suspicious vendor email your team received? Forward it to security@familysentinel.org — no charge, no strings. Questions: (940) 281-6672.