A Tesco Clubcard points expiry attack, where a convincing redemption flow and a small delivery fee make handing over card details feel routine.

A real American Express order confirmation carrying a fake PayPal charge and an attacker-controlled phone number.

A fake court summons attack threatens legal enforcement action to rush recipients into a Microsoft credential harvester.

A fake annual performance review, where a QR code hidden inside a PowerPoint attachment quietly bypasses email link scanning to steal Microsoft credentials.

A fake fund-recovery service targets people who already lost money to investment fraud, sent through a real email marketing platform to slip past filters.

A Google Ads on Air impersonation, where genuine branding, a real third-party mailing platform, and zero urgency combine to make a credential-harvesting page feel routine.

A fake project collaboration invite, where a calm, urgency-free pretext and a simulated live Teams meeting lull recipients into entering their Microsoft password not once, but twice.

How attackers misuse legitimate third-party services to deliver callback phishing, why it's hard to catch, and how to harden your services against it.