What is TOAD (Telephone-Oriented Attack Delivery)?

TOAD attack isn’t just about unsolicited phone calls. It’s a blend of psychological manipulation and technology designed to exploit trust and urgency. Whether it’s fake tech support, fraudulent bank calls, or messages urging immediate action, these attacks are becoming increasingly difficult to detect.

In this blog, we’ll explore how TOAD works, why it’s so effective, and actionable ways to safeguard yourself and your organization from this growing threat.

Definition of TOAD

TOADs are a type of phishing scam where cybercriminals use real phone numbers to impersonate legitimate callers, tricking victims into revealing sensitive information, such as usernames, passwords, and credit card details. The term "TOADs" refers to Telephone Oriented Attack Delivery. Scammers may also use this information to take over accounts or make fraudulent purchases, resulting in significant financial losses for businesses.

Why TOADs Are Surging

The Telephone-Oriented Attack Delivery threat landscape has exploded in 2025, driven by the rapid proliferation of AI-powered voice cloning tools like ElevenLabs and Resemble AI. These tools now enable hyper-realistic impersonation attacks, with AI voice cloning scams surging by 300% since 2023, as cybercriminals exploit the accessibility of these technologies for malicious purposes (Source). For instance, the FTC reported a staggering $2.7 billion in losses from impostor scams in 2023, many linked to AI-driven voice spoofing (Source). 10 million TOAD attacks occur monthly, with ransomware groups actively recruiting "TOAD specialists" to refine their social engineering tactics (Source).

TOAD in 2024‑2025: Why the Threat Keeps Growing

Toad is attack vector that feels personal, urgent and convincing – exactly what social engineers need to make smart people override their scepticism. So, it is growing day by day. Here are some points why it is surging:

• AI voice cloning goes mainstream: Free online tools can reproduce a target’s voice from a 60‑second sample, letting criminals impersonate executives with chilling accuracy.
• TOAD‑as‑a‑Service: Underground platforms such as QuattrO rent multilingual “agents”, auto‑diallers and spoofed caller‑ID ranges for a subscription fee – no technical skill required.
• 10 million+ monthly attempts: It is measured a 554 % year‑on‑year jump in telephone‑enabled phishing campaigns.

What Makes The Telephone-Oriented Attack Delivery Unique?

One of the most striking features of TOADs is the deployment of AI-powered tactics, where attackers use deepfake technology to mimic the voices of trusted individuals such as CEOs, colleagues, or clients. This was exemplified in a 2024 incident involving a UK bank, where a deepfake of the CFO was used to authorize fraudulent financial transfers, demonstrating the potential for significant financial and reputational damage (Source).

In addition to AI-driven voice impersonation, TOADs employ hybrid social engineering strategies that combine digital and voice communication to manipulate victims. For example, attackers might send a phishing email and then follow up with a phone call, asking questions like, “Did you get my email about the invoice?” This multi-channel approach exploits human trust and makes the scam more convincing by creating a sense of urgency and familiarity.

Furthermore, TOADs leverage QR code phishing, commonly known as quishing, to bypass traditional email security solutions. By embedding malicious QR codes in emails, attackers can redirect unsuspecting users to fraudulent websites that may automatically initiate calls to fake support numbers or prompt the download of malware. This method capitalizes on the increasing use of QR codes in everyday transactions, making it a particularly insidious threat.

What sets TOADs apart in 2025 is the seamless integration of these advanced techniques, which together create a highly effective and difficult-to-detect form of social engineering tactics. By combining AI-generated voice impersonation, multi-vector social engineering, and innovative phishing methods like quishing, TOADs represent a significant evolution in the tactics used by cybercriminals. As such, they pose a critical challenge to organizations and individuals alike, necessitating enhanced vigilance and the development of new defensive strategies to counteract these sophisticated threats.

How Does a TOAD Attack Work?

TOAD threats are highly organized and can target individuals or businesses. The attackers use a combination of phone calls, SMS, emails, or even voicemail to orchestrate their attacks.

Common Tactics in TOAD Attacks

• Spoofed Caller IDs: Attackers use fake caller IDs to appear as legitimate entities, such as banks, government agencies, or well-known brands.
• Pre-Call Setup: Often, the victim receives a phishing email or text urging them to call a specific number. (Learn more about spear-phishing attacks.)
• Emotional Manipulation: Attackers create a sense of urgency or fear—claiming, for example, that the victim’s account is compromised or they owe money to the government.
• Malicious Instructions: During the call, victims may be asked to share sensitive information like passwords, PINs, or account numbers; install malware disguised as software or support tools; transfer money to "resolve an issue" or "secure their account."

For example, attackers often combine vishing techniques with fake emails in a pretexting scenario to increase credibility.

The Effects of TOAD Attacks on Business

The impact of TOAD on businesses can be severe, with significant financial losses, reputation damage, decreased business productivity, and a loss of customer trust.

• According to the Federal Trade Commission (FTC) in the United States, businesses reported losing a total of $1.8 billion to imposter scams, including vishing, in 2020 alone.
• The Better Business Bureau (BBB) in the US also reported that businesses lost an average of $7,640 to vishing scams in 2020, with some individual losses reaching as high as $500,000.
• In a survey conducted by Pindrop Security in 2019, nearly 60% of businesses reported that they had experienced a vishing attack in the previous 12 months. The average financial loss reported by these businesses was $43,000 per incident, with some losses exceeding $1 million.
• In the UK, the cost of fraud to businesses reached £1.2 billion in 2020, according to a report by UK Finance. The report found that vishing was one of the most common types of fraud reported by businesses, with losses totaling £37.8 million.

It is clear that TOAD can result in significant financial losses to businesses, with some individual losses reaching into the millions of dollars. However, the exact cost of these attacks can vary widely depending on a range of factors, and it can be difficult to measure the total impact of voice scams on businesses worldwide. But, these losses can be devastating for small and medium-sized enterprises, leading to bankruptcy in some cases.

Additionally, businesses that fall victim to TOADs may lose customers' trust, resulting in long-term reputation damage and lost revenue.

How Do TOAD Attacks Happen?

Callback phishing, also known as TOAD, tricks people into calling certain phone numbers. These numbers usually connect you to fake call centers. When someone calls, they can be fooled into installing malicious software or tools on their computers.

Let's look at an example to see TOAD attacks happens:

1. The Initial Contact: A user receives an email, which appears to be from a reputable company, such as Amazon or PayPal.
2. The Fake Invoice: Within the email, there's an invoice for a large purchase that the user doesn't recall making. Despite being fake, the invoice looks very authentic, mimicking real ones.
3. Raising Suspicion: The invoice raises alarm bells for the recipient. What's peculiar here is that there are no links to click or attachments to open, which diverges from typical phishing scams.
4. Prompting a Call: The email urges the recipient to dial a customer service number, often pretending to be in the US, for any inquiries about the invoice. Concerned, the user decides to make the call.
5. The Deception: On the other end of the line is a scammer, not a genuine customer service agent. They convince the user they can sort out the issue but need access to the user's computer to do so. They guide the user to download what is claimed to be a support tool, which is actually malware allowing remote access.
6. The Consequence: With the malware installed, the scammer gains complete access to the user's computer, risking personal information and further exploitation. This method is distinct from regular phishing attempts, leveraging direct phone interaction to manipulate the victim, adding a layer of complexity beyond digital phishing schemes.

It's also worth noting that attackers might not directly install malware themselves. Sometimes, they direct the user to a website that downloads malware, like BazaLoader, which then can introduce various types of harmful software.

Example of TOAD Attacks

Here are some real-world examples of TOAD attacks:

• The Amazon Customer Vishing Scam: Back in 2020, con artists impersonated Amazon employees and reached out to Amazon customers via phone calls or voicemails. These scammers didn't specifically target any particular person or organization.
• The Scam Involving IRS Impersonation: This type of scam has persisted for years, affecting individuals and businesses throughout the United States. The IRS cautioned people in 2019 about a surge in such scams. No specific victims have been named.
• The One-Ring Scam Warning: In 2019, the Federal Communications Commission (FCC) alerted the public about the one-ring scam, which targeted people and businesses across the country. The victims in this case remain unidentified.
• The Escalation of Tech Support Scams: In 2018, Microsoft published a report revealing a 24% increase in tech support scams from the previous year. The affected individuals have not been disclosed.
• The Social Security Scam Alert: In 2018, the Social Security Administration (SSA) warned the public about a new scheme involving scammers pretending to be SSA employees and asking individuals for their personal information. No victims have been named.
• The Marriott Data Breach Incident: Marriott International disclosed a data breach in 2018 that had persisted since 2014. The breach compromised the personal details of nearly 500 million clients, including their names, phone numbers, email addresses, passport numbers, and credit card data. The culprits reportedly employed phone phishing to infiltrate Marriott's system.
• The Capital One Data Breach Announcement: In 2019, Capital One revealed a data breach that exposed the personal information of more than 100 million customers and applicants, including names, addresses, phone numbers, and credit scores. The attacker exploited a misconfigured firewall and used phone calls and emails to deceive Capital One employees into providing access to the company's cloud storage.
• The Twitter Bitcoin Scam Incident: In 2020, multiple high-profile Twitter accounts, such as those of Elon Musk, Bill Gates, and Barack Obama, were compromised in a bitcoin scam. The hackers employed phone phishing to access the accounts and subsequently posted tweets encouraging followers to send bitcoin to a specific address with the promise of a larger return.
• The WhatsApp Spyware Attack: A security flaw in WhatsApp was exploited by an Israeli cyber intelligence firm in 2019 to plant spyware on the phones of journalists, human rights activists, and political dissidents. The attackers allegedly used phone calls to initiate the spyware installation.

New Twists To Watch in 2025

Here are some new Toad tactics organizations should be aware of in 2025:

• Deepfake double‑teams: Fraudsters now pair AI voice cloning with synthetic video for persuasion during conference‑call platforms. If your verification relies on seeing or hearing the right executive, rethink it.
• Multilingual call centres: TOAD rings can switch languages mid‑call, targeting global help desks and confusing first‑line agents who rely on caller familiarity as a trust signal.
• MFA code harvesting: Scammers increasingly trigger real push notifications, then phone the victim pretending to be the security team investigating strange log‑ins – and ask the target to read out the code “to block the attacker”.
• Supply‑chain pivoting: Fake invoices now piggy‑back on legitimate SaaS billing systems (Intuit, Zoho, DocuSign), making domain‑reputation filters useless and raising conversion rates.

How to Protect Against TOAD Attacks

To combat the growing threat of TOADs, businesses can implement various solutions.

• Educate employees: Train your employees to recognize and report potential TOADs. Teach them how to identify suspicious phone calls and emails, and provide them with clear guidelines on how to respond to these types of attacks.
• Stay up-to-date on emerging threats: Use Callback Simulation tools, which is training exercise designed to educate employees and raise security awareness training about callback voice phishing. It involves simulating a callback voice phishing attack and evaluating how employees respond to the attack.
• Implement multi-factor authentication: Require multi-factor authentication for all sensitive accounts and transactions. This can help prevent fraudsters from gaining access to your systems, even if they have obtained some of your employees' login credentials.
• Use call blocking and filtering technologies: Implement call blocking and filtering technologies to prevent known fraudsters and robocallers from reaching your employees and customers.
• Establish clear policies and procedures: Establish clear policies and procedures for handling sensitive information over the phone. Make sure your employees understand these policies and procedures, and enforce them consistently.

How to Prevent Telephone-Oriented Attack Delivery Threats with Keepnet?

At Keepnet, we recognize the significance of safeguarding your business from the threat of telephone scams like TOAD and Vishing Scams. To help you achieve this, we provide you with a Vishing Simulator and Callback Phishing Simulator products that enables you to assess and train your employees by conducting simulated phone calls. By monitoring your employees' reactions to these mock attacks, we help you equip your staff with crucial insights for your organization's readiness against threats, pinpointing areas that require enhancement.

Furthermore, we focus on educating employees and raising awareness about voice phishing attacks. After simulating realistic attack scenarios and evaluating employee responses, we customize your training and awareness programs to bolster your business's defenses against such threats.

Take a proactive step towards protecting your business with Keepnet's risk-free and compliance-ready Human Risk Management solutions.

Watch Keepnet's Webinar on YouTube and see how vishing works, impacts and Vishing Simulator to fight againts TOAD, voice phishing attacks.

Please also watch our Callback Phishing Simulator and how it helps your employees to identify and report callback (telephone oriented attack delivery) attacks up to %92 success.

Editor's Note: This blog was updated on April 28, 2025.