What is TOAD (Telephone-Oriented Attack Delivery)?

Telephone Oriented Attack Delivery attack isn’t just about unsolicited phone calls. It’s a blend of psychological manipulation and technology designed to exploit trust and urgency. Whether it’s fake tech support, fraudulent bank calls, or messages urging immediate action, these attacks are becoming increasingly difficult to detect.

In this blog, we’ll explore how TOAD works, why it’s so effective, and actionable ways to safeguard yourself and your organization from this growing threat.

What is the Definition of TOAD

TOADs are a type of phishing scam where cybercriminals use real phone numbers to impersonate legitimate callers, tricking victims into revealing sensitive information, such as usernames, passwords, and credit card details. The term "TOADs" refers to Telephone Oriented Attack Delivery. Scammers may also use this information to take over accounts or make fraudulent purchases, resulting in significant financial losses for businesses.

Why Telephone Oriented Attack Delivery Attacks Are Surging?

The Telephone-Oriented Attack Delivery threat landscape has exploded in 2025, driven by the rapid proliferation of AI-powered voice cloning tools like ElevenLabs and Resemble AI. These tools now enable hyper-realistic impersonation attacks, with AI voice cloning scams surging by 300% since 2023, as cybercriminals exploit the accessibility of these technologies for malicious purposes (Source).

For instance, the FTC reported a staggering $2.7 billion in losses from impostor scams in 2023, many linked to AI-driven voice spoofing (Source). 10 million TOAD attacks occur monthly, with ransomware groups actively recruiting "TOAD specialists" to refine their social engineering tactics (Source).

TOAD in 2025: Why the Threat Keeps Growing

Telephone-oriented attack deliveries are now scalable, automated, and widely available, making them a serious concern for every business. What was once a niche scam tactic has evolved into an industrialized attack vector—and here’s why it’s exploding in 2025 and beyond:

• AI voice cloning goes mainstream: Free online tools can reproduce a target’s voice from a 60‑second sample, letting criminals impersonate executives with chilling accuracy.
• TOAD‑as‑a‑Service: Underground platforms such as QuattrO rent multilingual “agents”, auto‑diallers and spoofed caller‑ID ranges for a subscription fee – no technical skill required.
• 10 million+ monthly attempts: It is measured a 554 % year‑on‑year jump in telephone‑enabled phishing campaigns.

What Makes The Telephone-Oriented Attack Delivery Unique?

One of the most striking features of Telephone Oriented Attack Delivery is the deployment of AI-powered tactics, where attackers use deepfake technology to mimic the voices of trusted individuals such as CEOs, colleagues, or clients. This was exemplified in a 2024 incident involving a UK bank, where a deepfake of the CFO was used to authorize fraudulent financial transfers, demonstrating the potential for significant financial and reputational damage (Source).

In addition to AI-driven voice impersonation, TOADs employ hybrid social engineering strategies that combine digital and voice communication to manipulate victims. For example, attackers might send a phishing email and then follow up with a phone call, asking questions like, “Did you get my email about the invoice?” This multi-channel approach exploits human trust and makes the scam more convincing by creating a sense of urgency and familiarity.

Furthermore, TOADs leverage QR code phishing, commonly known as quishing, to bypass traditional email security solutions. By embedding malicious QR codes in emails, attackers can redirect unsuspecting users to fraudulent websites that may automatically initiate calls to fake support numbers or prompt the download of malware. This method capitalizes on the increasing use of QR codes in everyday transactions, making it a particularly insidious threat.

What sets TOADs apart in 2025 is the seamless integration of these advanced techniques, which together create a highly effective and difficult-to-detect form of social engineering tactics. By combining AI-generated voice impersonation, multi-vector social engineering, and innovative phishing methods like quishing, TOADs represent a significant evolution in the tactics used by cybercriminals. As such, they pose a critical challenge to organizations and individuals alike, necessitating enhanced vigilance and the development of new defensive strategies to counteract these sophisticated threats.

What Are Common Tactics in Telephone Oriented Attack Delivery Attacks?

Telephone-Oriented Attack Delivery campaigns are rarely random or improvised, they follow a deliberate and well-structured sequence designed to exploit human trust, urgency, and confusion. Based on cases analyzed by Keepnet, these are the most common tactics used by attackers:

• Caller ID Spoofing: Threat actors disguise their phone number to appear as a trusted source—such as a bank, a government agency, or a well-known tech company—making the call seem legitimate at first glance.
• Pretext Setup via Email or SMS: Victims are often primed through a phishing email or text message that warns of suspicious activity or payment issues. These messages urge recipients to call a fake customer service number, unknowingly connecting them with the attacker.
• Emotional Manipulation: Once on the call, the attacker creates a sense of urgency or fear. Common narratives include claims that the victim’s account has been compromised, that they owe taxes or fines, or that their services will be suspended if they don’t act immediately.
• Malicious Guidance: With the victim under pressure, the attacker requests sensitive information such as login credentials, MFA codes, or payment details. In some cases, the victim is instructed to install “remote support” software, which is actually malware designed to provide system access.
• Multilingual and Regional Targeting: Attackers increasingly use language localization to sound more authentic, mimicking regional accents or speaking the victim’s native language to build trust.
• Time-Based Pressure: Many TOAD calls are strategically timed—late in the day, during shift changes, or on weekends—when supervision is lower and decision-making may be rushed.
• Use of Background Noise: To simulate a real call center environment, attackers may play background office sounds or chatter to make the call seem more credible.
• Data from Breaches: Some attackers leverage breached or leaked data (like partial credit card numbers, names of coworkers, or job titles) to make their pretext more believable.
• Callbacks from Missed Calls: In some campaigns, attackers intentionally drop a call to trigger a callback. When the victim returns the call, they unknowingly engage with the scammer on their terms.
• Layered Attacks with Multiple Channels: A TOAD attack may begin on the phone but continue via email, SMS, or even fake websites. This multi-channel approach reinforces the deception and increases success rates.
• Use of AI-Generated Voices: Advanced attackers now use AI voice cloning to mimic executives or colleagues, making the scam almost indistinguishable from a real internal call.

Understanding these tactics is significant. Unlike traditional phishing, TOAD attacks exploit voice calls, making them harder to detect and easier to fall for—especially when combined with spoofed identities and well-researched pretexts.

What are Effects of TOAD Attacks on Business

The impact of TOAD on businesses can be severe, with significant financial losses, reputation damage, decreased business productivity, and a loss of customer trust. The consequences for businesses can be severe and far-reaching:

• Data Breaches and Credential Theft: TOAD attacks frequently result in the disclosure of sensitive information such as login credentials, financial data, or customer records. Once compromised, these assets can be used to access internal systems or sold on the dark web.
• Financial Losses: Attackers may trick employees into initiating fraudulent transactions, purchasing gift cards, or approving unauthorized wire transfers. In many cases, these actions are irreversible and not covered by cyber insurance.
• Operational Disruption: Successful TOAD incidents can lead to malware deployment, ransomware infections, or unauthorized access to critical systems. The resulting downtime can cripple daily operations and require costly remediation.
• Reputational Damage: When attackers impersonate company representatives or executives, the damage extends beyond internal losses. Clients, partners, and the public may lose confidence in the organization’s ability to safeguard sensitive interactions.
• Regulatory and Legal Consequences: Businesses affected by TOAD-related breaches may be subject to regulatory scrutiny, fines, or legal action—particularly if customer or employee data is involved and proper precautions were not in place.
• Increased Internal Risk: These attacks expose gaps in employee awareness and response procedures. A single successful call can reveal weaknesses in training programs, call verification protocols, and incident response readiness.

To defend against these risks, organizations must combine technology, policy, and human resilience—ensuring that employees are trained not just to spot email phishing, but to verify voice-based requests, especially those involving urgency, secrecy, or sensitive actions.

How TOADs Leads to Business Losses: Real Stats & Costs

Businesses that fall victim to TOADs may lose customers' trust, resulting in long-term reputation damage and lost revenue.

Here are some real facts and figures telephone oriented attack delivery cause:

• According to the Federal Trade Commission (FTC) in the United States, businesses reported losing a total of $1.8 billion to imposter scams, including call scams, in 2020 alone.
• The Better Business Bureau (BBB) in the US also reported that businesses lost an average of $7,640 to call based scams in 2020, with some individual losses reaching as high as $500,000.
• In a survey conducted by Pindrop Security in 2019, nearly 60% of businesses reported that they had experienced a vishing attack in the previous 12 months. The average financial loss reported by these businesses was $43,000 per incident, with some losses exceeding $1 million.
• In the UK, the cost of fraud to businesses reached £1.2 billion in 2020, according to a report by UK Finance. The report found that call scams was one of the most common types of fraud reported by businesses, with losses totaling £37.8 million.

It is clear that TOAD can result in significant financial losses to businesses, with some individual losses reaching into the millions of dollars. However, the exact cost of these attacks can vary widely depending on a range of factors, and it can be difficult to measure the total impact of call scams on businesses worldwide. But, these losses can be devastating for small and medium-sized enterprises, leading to bankruptcy in some cases.

How Do TOAD Attacks Work?

TOAD attacks don’t start with a phone call—they start with a fake invoice in your inbox. These attacks are carefully crafted to trick victims into calling a number, where a scammer awaits on the other end. To understand how this tactic works step by step, let’s break down a real-world example:

1. The Initial Contact: A user receives an email, which appears to be from a reputable company, such as Amazon or PayPal.
2. The Fake Invoice: Within the email, there's an invoice for a large purchase that the user doesn't recall making. Despite being fake, the invoice looks very authentic, mimicking real ones.
3. Raising Suspicion: The invoice raises alarm bells for the recipient. What's peculiar here is that there are no links to click or attachments to open, which diverges from typical phishing scams.
4. Prompting a Call: The email urges the recipient to dial a customer service number, often pretending to be in the US, for any inquiries about the invoice. Concerned, the user decides to make the call.
5. The Deception: On the other end of the line is a scammer, not a genuine customer service agent. They convince the user they can sort out the issue but need access to the user's computer to do so. They guide the user to download what is claimed to be a support tool, which is actually malware allowing remote access.
6. The Consequence: With the malware installed, the scammer gains complete access to the user's computer, risking personal information and further exploitation. This method is distinct from regular phishing attempts, leveraging direct phone interaction to manipulate the victim, adding a layer of complexity beyond digital phishing schemes.

It's also worth noting that attackers might not directly install malware themselves. Sometimes, they direct the user to a website that downloads malware, like BazaLoader, which then can introduce various types of harmful software.

What are the Example of TOAD Attacks?

Here are some real-world examples of Telephone Oriented Attack Delivery attacks:

• The Amazon Customer Vishing Scam: Back in 2020, con artists impersonated Amazon employees and reached out to Amazon customers via phone calls or voicemails. These scammers didn't specifically target any particular person or organization.
• The Scam Involving IRS Impersonation: This type of scam has persisted for years, affecting individuals and businesses throughout the United States. The IRS cautioned people in 2019 about a surge in such scams. No specific victims have been named.
• The One-Ring Scam Warning: In 2019, the Federal Communications Commission (FCC) alerted the public about the one-ring scam, which targeted people and businesses across the country. The victims in this case remain unidentified.
• The Escalation of Tech Support Scams: In 2018, Microsoft published a report revealing a 24% increase in tech support scams from the previous year. The affected individuals have not been disclosed.
• The Social Security Scam Alert: In 2018, the Social Security Administration (SSA) warned the public about a new scheme involving scammers pretending to be SSA employees and asking individuals for their personal information. No victims have been named.
• The Marriott Data Breach Incident: Marriott International disclosed a data breach in 2018 that had persisted since 2014. The breach compromised the personal details of nearly 500 million clients, including their names, phone numbers, email addresses, passport numbers, and credit card data. The culprits reportedly employed phone phishing to infiltrate Marriott's system.
• The Capital One Data Breach Announcement: In 2019, Capital One revealed a data breach that exposed the personal information of more than 100 million customers and applicants, including names, addresses, phone numbers, and credit scores. The attacker exploited a misconfigured firewall and used phone calls and emails to deceive Capital One employees into providing access to the company's cloud storage.
• The Twitter Bitcoin Scam Incident: In 2020, multiple high-profile Twitter accounts, such as those of Elon Musk, Bill Gates, and Barack Obama, were compromised in a bitcoin scam. The hackers employed phone phishing to access the accounts and subsequently posted tweets encouraging followers to send bitcoin to a specific address with the promise of a larger return.
• The WhatsApp Spyware Attack: A security flaw in WhatsApp was exploited by an Israeli cyber intelligence firm in 2019 to plant spyware on the phones of journalists, human rights activists, and political dissidents. The attackers allegedly used phone calls to initiate the spyware installation.

What are New Telephone Oriented Attack Delivery Twists To Watch in 2025

Here are some new Telephone-Oriented Attack Delivery tactics organizations should be aware of in 2025:

• Deepfake double‑teams: Fraudsters now pair AI voice cloning with synthetic video for persuasion during conference‑call platforms. If your verification relies on seeing or hearing the right executive, rethink it.
• Multilingual call centres: TOAD rings can switch languages mid‑call, targeting global help desks and confusing first‑line agents who rely on caller familiarity as a trust signal.
• MFA code harvesting: Scammers increasingly trigger real push notifications, then phone the victim pretending to be the security team investigating strange log‑ins – and ask the target to read out the code “to block the attacker”.
• Supply‑chain pivoting: Fake invoices now piggy‑back on legitimate SaaS billing systems (Intuit, Zoho, DocuSign), making domain‑reputation filters useless and raising conversion rates.

How to Protect Against TOAD Attacks

TOAD attacks don’t just target your technology—they exploit your people. And because these voice-based scams are fast, personal, and often sound legitimate, even experienced employees can be caught off guard. The good news? With the right strategy, tools, and training, businesses can dramatically reduce their risk and stop TOAD attacks before any damage is done.

Here’s how:

• Educate employees: Train your employees to recognize and report potential TOADs. Teach them how to identify suspicious phone calls and emails, and provide them with clear guidelines on how to respond to these types of attacks.
• Stay up-to-date on emerging threats: Use Callback Simulation tools, which is training exercise designed to educate employees and raise security awareness training about callback voice phishing. It involves simulating a callback voice phishing attack and evaluating how employees respond to the attack.
• Implement multi-factor authentication: Require multi-factor authentication for all sensitive accounts and transactions. This can help prevent fraudsters from gaining access to your systems, even if they have obtained some of your employees' login credentials.
• Use call blocking and filtering technologies: Implement call blocking and filtering technologies to prevent known fraudsters and robocallers from reaching your employees and customers.
• Establish clear policies and procedures: Establish clear policies and procedures for handling sensitive information over the phone. Make sure your employees understand these policies and procedures, and enforce them consistently.

How Keepnet Helps to Prevent Telephone-Oriented Attack Delivery Threats?

At Keepnet, we recognize the significance of safeguarding your business from the threat of telephone scams like TOAD and Vishing Scams. To help you achieve this, we provide you with a Vishing Simulator and Callback Phishing Simulator products that enables you to assess and train your employees by conducting simulated phone calls. By monitoring your employees' reactions to these mock attacks, we help you equip your staff with crucial insights for your organization's readiness against threats, pinpointing areas that require enhancement.

Furthermore, we focus on educating employees and raising awareness about voice phishing attacks. After simulating realistic attack scenarios and evaluating employee responses, we customize your training and awareness programs to bolster your business's defenses against such threats.

Take a proactive step towards protecting your business with Keepnet's risk-free and compliance-ready Human Risk Management solutions.

Watch Keepnet's Webinar on YouTube and see how vishing works, impacts and Vishing Simulator to fight againts TOAD, voice phishing attacks.

Please also watch our Callback Phishing Simulator and how it helps your employees to identify and report callback (telephone oriented attack delivery) attacks up to %92 success.

Editor's Note: This blog was updated on Jul 11, 2025.