What happens when users call the number in a telephone-oriented phishing email?

Why a phone call changes the attack from static to interactive

The number is the handoff from a one-way lure into a live social-engineering session. Once the victim dials in, the attacker can adapt in real time, answer objections, and steer the person through a sequence that is harder to stop than an email alone. That interaction is what makes telephone-oriented phishing so effective.

A phone conversation also gives the attacker an opportunity to establish urgency and authority, then use that momentum to move the victim back to the computer or mobile device for the next action. In practice, the call often becomes the control channel for the rest of the attack, not a separate event.

What the attacker typically tries to do next

After the call begins, the attacker usually works toward one of three outcomes: forcing a click on a malicious link, getting the user to install remote-access or support software, or extracting secrets directly over the phone. The exact script varies, but the intent is to convert trust gained in conversation into execution on the victim’s device or disclosure of information.

This is why telephone phishing commonly bridges multiple abuse paths. The attacker may start with a convincing story, then pivot to browser activity, remote-control tooling, or credential capture once the victim has accepted the premise. If the call succeeds, the email has already done its job of opening the door.

That same pattern appears in credential theft and token abuse campaigns that rely on the victim to create the final access step. MailChimp Breach is a useful reminder that social engineering is often the point where access moves from attempted to real, while CoPhish OAuth Token Theft via Copilot Studio shows how a live interaction can be used to push a victim into handing over something that functions like a session key.

Why the computer or browser still matters after the call

The call usually is not the objective by itself. It is a guided transition to a second stage where the victim is told to open a link, approve a prompt, share a code, or install software. At that point the attacker can move from persuasion to technical compromise, because the user is now acting inside the attacker’s script rather than resisting it.

That transition is especially dangerous when the victim believes the call validated the request. The attacker can use the phone to remove hesitation, then direct the user toward a login page, a remote-access tool, or a document that appears routine. The browser, device, and account then become the real targets.

For defenders, the important lesson is that email filters alone do not end the risk. The call creates a second path around initial suspicion, so the security model has to treat the phone number as part of the attack chain, not as harmless contact information. Guidance on stronger authentication and phishing-resistant verification practices is useful here, especially NIST SP 800-63 Digital Identity Guidelines, because the attacker’s goal is often to bypass weak user-mediated checks rather than to exploit the email itself.

Risk and Threat Considerations

Phone-based follow-up increases the chance that a victim will override normal caution because the attacker can react to objections, build trust, and escalate pressure in the moment. That makes the risk less about the initial email and more about the attacker’s ability to convert conversation into execution on the victim’s device or account.

Failure mechanism: The attacker uses live conversation to lower resistance, then guides the victim into actions that create compromise, such as opening a malicious link, authorising a prompt, installing software, or revealing sensitive information.

Impact: The result can be credential theft, session compromise, remote access, malware delivery, or a wider breach path that starts with persuasion and ends with unauthorized access.

Practitioner Guidance

What to verify: Treat any request to “call this number” as part of the suspicious workflow, not as reassurance. Verify the claimed sender and the requested action through an independent channel that does not reuse the contact details in the email.

What practitioners underestimate: The live voice interaction is often the point where the attacker gains enough confidence to push for the highest-value step, so user awareness training should focus on what happens after the call, not only on detecting the email itself.

Practitioner takeaway: The defensive mistake is assuming the call is the end of the scam; in practice, it is often the moment the attacker gains enough control to turn deception into action.

Related resources from NHI Mgmt Group

• What happens when users are pushed to call a fake security hotline from a phishing page?
• What happens when users click phishing links from email without browser protections?
• How should security teams reduce email phishing risk when users still need access to business systems and data?
• What happens when phishing and social engineering succeed against crypto users?