The Phishing That Costs Money Never Asks You to Click a Link

The invoice came in as a PDF. It named a subscription the recipient half remembered, showed a charge just large enough to worry about, and printed a support number to call if the renewal was a mistake. No link. No macro. Nothing to download. Accounts payable dialled the number, a calm and helpful person answered, and forty minutes later a remote support tool was running on a workstation inside the network.

Nothing in that sequence matches the phishing most staff were trained to spot. No misspelled domain, no broken English, no attachment with a double extension. The lure worked because it contained none of the things the training told people to look for.

The complaint column and the loss column disagree

The FBI's 2025 Internet Crime Report logged 1,008,597 complaints and $20.877 billion in reported losses, a 26 percent rise in losses over 2024. Phishing and spoofing was the most reported crime type in the country at 191,561 complaints. It accounted for $215.8 million of those losses.

Business email compromise accounted for $3.047 billion. Tech support fraud drew 47,794 complaints and $2.135 billion. Both of those totals usually begin with a lure, and neither gets filed under the word phishing. The category people report is the cheap end. The expensive endings are recorded under the name of whatever happened after somebody believed the message.

This applies to you if email, Teams, Slack, or a telephone can reach anyone who approves an MFA prompt, opens an attachment, changes a bank record, or releases a payment. If your staff have no cloud mailbox, no single sign-on, and nobody with authority to move money, this one is not yours. If you came for the relay mechanics and the sign-in log queries, we published those in Caller-Led Vishing Kits Are Defeating Okta MFA in Real Time and UNC6671: Vishing Personal Phones to Steal Live M365, Okta, and Salesforce Sessions. This guide is for the people in the building who will never read a sign-in log.

Four lures that skip the link

A QR code inside a PDF attachment

Microsoft's Q2 2026 email threat report tracked QR code phishing from 7.6 million attacks in January to a peak of 18.7 million in March, then down to 8.3 million by June. Delivery moved with it: PDF attachments carried 79 percent of QR attacks in April and 58 percent by June, while Office documents rose to 40 percent. Across the same quarter Microsoft counted roughly 7.6 billion email phishing threats, of which credential theft was the goal in 94 to 96 percent of payload attacks.

A QR code is an image of a URL. Your mail filter sees a picture. The victim then leaves the managed laptop, points a personal phone at the screen, and lands on a login page your controls never touch. That is why "scan this code to view the payroll notice" still works on people who would never click a strange link.

An invoice that carries only a phone number

Barracuda's August 2026 write-up of callback phishing, also called telephone-oriented attack delivery, catalogues five shapes of the same lure: a mass email with a slightly wrong brand name, a short message with the charge hidden in an image, an image-only receipt, a fully branded HTML invoice, and a calendar invitation. The payload is a phone number, which no filter can convict. Once the victim calls, a live operator adjusts the story in real time, asks for identity details, and talks the caller into installing remote access software.

A help desk that called you first

Arctic Wolf has tracked a campaign it calls PREY-0058 since 3 September 2026. Operators phone or text directors, vice presidents, executives and IT staff while impersonating the internal help desk, then walk the target onto an adversary-in-the-middle portal hosted on subdomains built from words like passkey, oskey, setpasskey, passkeydeploy and secure-passkey. The portal harvests the password and the MFA token for Microsoft 365 or Okta and Duo. Sign-ins then arrive through static residential proxy providers so the location looks ordinary. The operators bulk-collect mail, SharePoint, OneDrive and Box, and an extortion demand lands over TOX within hours carrying a 72-hour deadline and sample files as proof.

Microsoft documented the chat version on 2 September 2026: a Teams message from an external tenant, a pretext of "Microsoft Security Update" or account verification, and a request to start Quick Assist. Granting that session hands over interactive, credential-backed access, and the operator moves toward domain controllers and certificate authorities from there.

A colleague whose account is already gone

In January 2026 Microsoft traced a campaign that opened with mail from a compromised vendor account carrying a genuine SharePoint link. The sender was real, the domain was real, and the document request matched a workflow the recipient recognised. After the session cookie was stolen the attacker built inbox rules that deleted incoming mail and marked it read, phished more than 600 internal and external contacts from the hijacked mailbox, and tampered with the MFA registration to keep the account.

No training slide covers this one, because the sender genuinely is your supplier. The only signal left is the request itself: a payment detail that changed, a document that needs a fresh login, a reply that arrives from an account that has gone quiet on every other thread.

The stop script staff can actually remember

Four shapes, one rule underneath all of them. Any contact detail supplied inside a message is supplied by whoever sent the message. The phone number in the invoice, the link in the alert, the QR code in the PDF, and the Teams handle claiming to be support all come from the same source, and that source is what you are trying to verify.

CISA's guidance for small and medium businesses puts it the same way: hover a link before clicking, use a search engine to look up the sender's phone number and contact them directly, and use a known contact method when a message appears to come from someone you know. CISA also states plainly that once-a-year training is not enough, because staff forget in eleven months what they learned in one afternoon.

Give people five habits and one sentence:

• Look the person up yourself. Directory, saved contact, or the number printed on the card. Never the number in the message.
• Never read a code aloud, and never approve a prompt you did not start. A real help desk has no reason to ask for either.
• Do not scan an unexpected QR code, and especially not on a personal phone, where none of your employer's protections apply.
• No remote support tool gets installed because of an inbound call. Sessions start from your side, on a ticket you opened.
• Report first, verify second. Reporting a real invoice costs the company thirty seconds. Reporting nothing costs it a mailbox.

The sentence, which every employee should be able to say without apology and without permission: "I am going to hang up and call the number in our directory. If this is genuine, we will be talking again in two minutes." Then they hang up. Say repeatedly that anyone who uses that line is doing their job, including when they use it on you.

The controls that make the habit hold

Four changes carry most of the weight for a small team.

Make reporting one click and never punish it. The report button in Outlook or Gmail, a monitored address, and a written promise that no one is disciplined for a false alarm. Shame is what turns a clicked link into a four-day incident, because the person who clicked waits to see whether anything bad happens.

Fix the MFA order before the MFA count. CISA's phishing-resistant MFA fact sheet ranks the options: FIDO and WebAuthn or PKI-based authentication at the top, app or token one-time passcodes and push with number matching next, push without number matching below that, and SMS or voice as a last resort. The fact sheet is direct about the middle tier for smaller organisations: "Authentication via app- or token-based OTP or mobile push with number matching are the best options for small- and medium-size business that cannot immediately implement phishing-resistant MFA." Start the hardware keys with the accounts that can move money or change identity: finance, the owner, whoever administers the tenant, and the help desk itself. Find out who is still relayable before you buy anything.

# Microsoft 365: who can still be relayed through a fake login page?
Connect-MgGraph -Scopes "AuditLog.Read.All","UserAuthenticationMethod.Read.All"

Get-MgReportAuthenticationMethodUserRegistrationDetail -All |
  Where-Object {
    $_.MethodsRegistered -notcontains 'passKeyDeviceBound' -and
    $_.MethodsRegistered -notcontains 'windowsHelloForBusiness'
  } |
  Select-Object UserPrincipalName, IsAdmin, MethodsRegistered |
  Sort-Object IsAdmin -Descending |
  Export-Csv .\phishable-mfa.csv -NoTypeInformation

Write the help-desk rule down. The help desk always calls back on a directory number. MFA enrollment, passkey registration and password resets never happen during a call the employee did not initiate. Restrict Teams messages from external tenants, and tell staff in advance that IT will never cold-call about authentication, which is the single line Arctic Wolf leads its own recommendations with.

Take the cheap technical wins. The joint CISA, NSA, FBI and MS-ISAC phishing guidance lists what smaller organisations should prioritise: anti-phishing training with a retention check rather than an attendance record, strong MFA on every internet-facing account, DNS filtering or firewall denylists, file-restriction policies that block .exe and .scr downloads on standard accounts, automatic software updates, safe browsing policies, and managed cloud email from a provider that patches and monitors for you.

One check is worth running today regardless: the mail rule that hides replies is the tell in almost every account takeover that turns into invoice fraud.

# Exchange Online: who quietly built a rule to hide the replies?
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) `
  -Operations New-InboxRule,Set-InboxRule,UpdateInboxRules -ResultSize 5000 |
  Select-Object CreationDate, UserIds, Operations |
  Sort-Object CreationDate -Descending | Format-Table -AutoSize

Publish the number your staff should call instead

Pick the one channel your people use when a message feels wrong: a phone number, a chat handle, an address, whichever they will actually reach for. Print it somewhere that does not require opening email, because the email is the thing in question. Tell every employee this week that the help desk will always hang up and call back, that nobody will be blamed for a false alarm, and that the sentence above is company policy rather than rudeness. Then run one fifteen-minute drill with a QR code and a fake invoice and see who reports it, who ignores it, and who calls the number on the page.

All four lures bet on the same thing: that nobody will spend two minutes checking through a channel the attacker does not control. That check costs nothing, and it works whether the next message arrives as a PDF, a phone call, a Teams ping, or a note from a supplier you have worked with for a decade.