Phish of the Week 28th of September

# Phish of the Week

# Phishing

American Express Order Misuse

Mette Luntama

Phish of the Week: Callback Phishing via American Express Order Misuse

This callback phishing attack misuses American Express's merchant supplies ordering to turn a real order confirmation into a fake PayPal billing alert. The email claims the recipient paid 620 USD and gives a phone number to cancel, aiming to get targets on a call with an attacker posing as PayPal support.

How the attack works:

The attacker starts by placing a merchant supplies order with American Express, in this case a contactless payments terminal topper. Instead of real customer details, the attacker enters a callback message into the name and shipping address fields: "You paid 620 USD. To cancel, call PayPal," followed by a phone number.

American Express's system then generates a standard order confirmation. As a result, the email comes from American Express Online Services on a legitimate American Express domain. Because the form fields feed directly into the email template, the attacker's text appears in the header, the greeting, and the shipping section.

The "To" field shows an address unrelated to the recipient. The email was not generated for the person reading it, even though it arrives looking like a normal order confirmation.

There is no malicious link or attachment. Its only call to action is the attacker-controlled phone number, which is the defining feature of callback phishing: instead of stealing data through a website, the attack moves the conversation from the inbox to a phone call.

A recipient who calls reaches an attacker posing as PayPal support. The goal of the call is to persuade the target into handing over payment details or account access.

Why the attack works:

The email is not spoofed. It is a real American Express message sent from American Express infrastructure, so the sender name, branding, and email authentication all check out. Recipients who have learned to inspect the sender address find nothing wrong with it.

The planted message does the persuading. A specific charge of 620 USD is alarming enough to prompt a quick response, and the phone number is presented as the only way to undo it. With no link to hover over and no attachment to question, calling feels like the responsible choice rather than a risk.

How to spot similar attacks:

An order confirmation arrives for a product the recipient never purchased

The "To" field shows an address that does not belong to the recipient

A charge from one company (PayPal) is described inside an email from a different company (American Express)

Billing details appear in unusual places, such as the greeting or the shipping address

A phone number is presented as the only way to cancel or dispute a charge

To check a charge or order, sign in to American Express or PayPal directly through their official app or website instead of calling any number listed in the email.

What is Phish of the Week?

Phish of the Week is a weekly content initiative by Hoxhunt's Threat Operations team. Each week, we highlight a current phishing trend or notable real-world attack, covering what the threat is, how it works, and what to watch for to spot similar attacks in the future. The goal is to build consistent recognition of evolving phishing themes and tactics over time.

Comments (0)

Popular