What is TOAD (Telephone-Oriented Attack Delivery)?

Cybercriminals are increasingly exploiting the human factor in cybersecurity, combining traditional methods with modern tools. One such emerging threat is Telephone-Oriented Attack Delivery (TOAD), a sophisticated social engineering technique where attackers use phone calls as their primary weapon to deceive victims. According to the FBI's 2023 Internet Crime Report, phone-based scams caused businesses to lose over $3.5 billion globally last year alone.

TOAD attack isn’t just about unsolicited phone calls. It’s a blend of psychological manipulation and technology, designed to exploit trust and urgency. Whether it’s fake tech support, fraudulent bank calls, or messages urging action, these attacks are becoming harder to detect.

In this blog, we’ll explore how TOAD works, why it’s so effective, and actionable ways to safeguard yourself and your organization from this growing threat.

Definition of TOAD Threats

Telephone oriented attack deliveries (TOADs), also named callback phishing, are becoming an increasingly common threat to businesses across the globe. The term "TOADs" refers to Threat Actors, Operators, and Developers—individuals or groups involved in orchestrating cyberattacks against businesses. Their activities have led to significant financial losses, operational disruptions, and reputational damage. Below are data-backed examples illustrating these impacts:

In 2024, U.S. Fortune 500 companies, excluding Microsoft, incurred approximately $5.4 billion in losses due to a global tech outage caused by a faulty update in CrowdStrike's security software, which affected systems running Microsoft Windows.

The 2023 cyberattack on MGM Resorts International, attributed to the hacking group Scattered Spider, led to significant operational disruptions, including the shutdown of hotel reservation systems and casino floors, resulting in substantial revenue losses and operational challenges.

In 2023, the cyberattack on MGM Resorts International not only caused operational disruptions but also led to reputational damage, as the company faced criticism over its cybersecurity measures and customer data protection, impacting customer trust and investor confidence.

TOADs are a type of phishing scam where cybercriminals use real phone numbers to impersonate legitimate callers, tricking victims into revealing sensitive information, such as usernames, passwords, and credit card details. Scammers may also use this information to take over accounts or make fraudulent purchases, resulting in significant financial losses for businesses.

To look futher details look at our blog on what is callback phishing?

How Does TOAD Attacks Work?

TOAD threats are highly organized and can target individuals or businesses. The attackers use a combination of phone calls, SMS, emails, or even voicemail to orchestrate their attacks.

Common Tactics in TOAD Attacks

• Spoofed Caller IDs: Attackers use fake caller IDs to appear as legitimate entities, such as banks, government agencies, or well-known brands.
• Pre-Call Setup: Often, the victim receives a phishing email or text urging them to call a specific number. (Learn more about spear-phishing attacks.)
• Emotional Manipulation: Attackers create a sense of urgency or fear—claiming, for example, that the victim’s account is compromised or they owe money to the government.
• Malicious Instructions: During the call, victims may be asked to share sensitive information like passwords, PINs, or account numbers; install malware disguised as software or support tools; transfer money to "resolve an issue" or "secure their account."

For example, attackers often combine vishing techniques with fake emails in a pretexting scenario to increase credibility.

The Effects of TOAD Attacks on Business

The impact of Voice Phishing Threat (TOAD) on businesses can be severe, with significant financial losses, reputation damage, decreased business productivity, and a loss of customer trust.

• According to the Federal Trade Commission (FTC) in the United States, businesses reported losing a total of $1.8 billion to imposter scams, including vishing, in 2020 alone.
• The Better Business Bureau (BBB) in the US also reported that businesses lost an average of $7,640 to vishing scams in 2020, with some individual losses reaching as high as $500,000.
• In a survey conducted by Pindrop Security in 2019, nearly 60% of businesses reported that they had experienced a vishing attack in the previous 12 months. The average financial loss reported by these businesses was $43,000 per incident, with some losses exceeding $1 million.
• In the UK, the cost of fraud to businesses reached £1.2 billion in 2020, according to a report by UK Finance. The report found that vishing was one of the most common types of fraud reported by businesses, with losses totaling £37.8 million.

It is clear that TOAD can result in significant financial losses to businesses, with some individual losses reaching into the millions of dollars. However, the exact cost of these attacks can vary widely depending on a range of factors, and it can be difficult to measure the total impact of voice scams on businesses worldwide. But, these losses can be devastating for small and medium-sized enterprises, leading to bankruptcy in some cases.

Additionally, businesses that fall victim to TOADs may lose customers' trust, resulting in long-term reputation damage and lost revenue.

How Do TOAD Attacks Happen?

Callback phishing, also known as TOAD, tricks people into calling certain phone numbers. These numbers usually connect you to fake call centers. When someone calls, they can be fooled into installing malicious software or tools on their computers.

Let's look at an example to see TOAD attacks happens:

1. The Initial Contact: A user receives an email, which appears to be from a reputable company, such as Amazon or PayPal.
2. The Fake Invoice: Within the email, there's an invoice for a large purchase that the user doesn't recall making. Despite being fake, the invoice looks very authentic, mimicking real ones.
3. Raising Suspicion: The invoice raises alarm bells for the recipient. What's peculiar here is that there are no links to click or attachments to open, which diverges from typical phishing scams.
4. Prompting a Call: The email urges the recipient to dial a customer service number, often pretending to be in the US, for any inquiries about the invoice. Concerned, the user decides to make the call.
5. The Deception: On the other end of the line is a scammer, not a genuine customer service agent. They convince the user they can sort out the issue but need access to the user's computer to do so. They guide the user to download what is claimed to be a support tool, which is actually malware allowing remote access.
6. The Consequence: With the malware installed, the scammer gains complete access to the user's computer, risking personal information and further exploitation. This method is distinct from regular phishing attempts, leveraging direct phone interaction to manipulate the victim, adding a layer of complexity beyond digital phishing schemes.

It's also worth noting that attackers might not directly install malware themselves. Sometimes, they direct the user to a website that downloads malware, like BazaLoader, which then can introduce various types of harmful software.

Example of TOAD Attacks

Here are some real-world examples of TOAD attacks:

• The Amazon Customer Vishing Scam: Back in 2020, con artists impersonated Amazon employees and reached out to Amazon customers via phone calls or voicemails. These scammers didn't specifically target any particular person or organization.
• The Scam Involving IRS Impersonation: This type of scam has persisted for years, affecting individuals and businesses throughout the United States. The IRS cautioned people in 2019 about a surge in such scams. No specific victims have been named.
• The One-Ring Scam Warning: In 2019, the Federal Communications Commission (FCC) alerted the public about the one-ring scam, which targeted people and businesses across the country. The victims in this case remain unidentified.
• The Escalation of Tech Support Scams: In 2018, Microsoft published a report revealing a 24% increase in tech support scams from the previous year. The affected individuals have not been disclosed.
• The Social Security Scam Alert: In 2018, the Social Security Administration (SSA) warned the public about a new scheme involving scammers pretending to be SSA employees and asking individuals for their personal information. No victims have been named.
• The Marriott Data Breach Incident: Marriott International disclosed a data breach in 2018 that had persisted since 2014. The breach compromised the personal details of nearly 500 million clients, including their names, phone numbers, email addresses, passport numbers, and credit card data. The culprits reportedly employed phone phishing to infiltrate Marriott's system.
• The Capital One Data Breach Announcement: In 2019, Capital One revealed a data breach that exposed the personal information of more than 100 million customers and applicants, including names, addresses, phone numbers, and credit scores. The attacker exploited a misconfigured firewall and used phone calls and emails to deceive Capital One employees into providing access to the company's cloud storage.
• The Twitter Bitcoin Scam Incident: In 2020, multiple high-profile Twitter accounts, such as those of Elon Musk, Bill Gates, and Barack Obama, were compromised in a bitcoin scam. The hackers employed phone phishing to access the accounts and subsequently posted tweets encouraging followers to send bitcoin to a specific address with the promise of a larger return.
• The WhatsApp Spyware Attack: A security flaw in WhatsApp was exploited by an Israeli cyber intelligence firm in 2019 to plant spyware on the phones of journalists, human rights activists, and political dissidents. The attackers allegedly used phone calls to initiate the spyware installation.

How to Protect Against TOAD Attacks

To combat the growing threat of TOADs, businesses can implement various solutions.

• Educate employees: Train your employees to recognize and report potential TOADs. Teach them how to identify suspicious phone calls and emails, and provide them with clear guidelines on how to respond to these types of attacks.
• Stay up-to-date on emerging threats: Use Vishing Simulation tools, which is training exercise designed to educate employees and raise security awareness training about voice phishing. It involves simulating a voice phishing attack and evaluating how employees respond to the attack.
• Implement multi-factor authentication: Require multi-factor authentication for all sensitive accounts and transactions. This can help prevent fraudsters from gaining access to your systems, even if they have obtained some of your employees' login credentials.
• Use call blocking and filtering technologies: Implement call blocking and filtering technologies to prevent known fraudsters and robocallers from reaching your employees and customers.
• Establish clear policies and procedures: Establish clear policies and procedures for handling sensitive information over the phone. Make sure your employees understand these policies and procedures, and enforce them consistently.

How to Prevent Telephone-Oriented Attack Delivery Threatswith Keepnet?

At Keepnet, we recognize the significance of safeguarding your business from the threat of telephone scams like TOAD and Vishing Scams. To help you achieve this, we provide you with a Vishing Simulator and Callback Phishing Simulator products that enables you to assess and train your employees by conducting simulated phone calls. By monitoring your employees' reactions to these mock attacks, we help you equip your staff with crucial insights for your organization's readiness against threats, pinpointing areas that require enhancement.

Furthermore, we focus on educating employees and raising awareness about voice phishing attacks. After simulating realistic attack scenarios and evaluating employee responses, we customize your training and awareness programs to bolster your business's defenses against such threats.

Take a proactive step towards protecting your business with Keepnet Labs' risk-free and compliance-ready fraud protection solutions. Schedule a demo or contact us for a free trial today.

Watch Keepnet's Webinar on YouTube and see how vishing works, impacts and Vishing Simulator to fight againts TOAD, voice phishing attacks.

Please also watch our Callback Phishing Simulator and how it helps your employees to identify and report callback (telephone oriented attack delivery) attacks up to %92 success.

Editor's Note: This blog was updated on December 4, 2024.