Australians have been advised over the years to not click on suspicious links or answer unknown numbers but cybercriminals have turned the tables with a new scam that gets people to call them.
It’s called the callback scam and it’s on the rise.
Telstra’s data shows it has grown from 29 per cent in 2025 to 45 per cent of reported email-based scams in 2026.
It usually starts with a person receiving an email about an unauthorised purchase, an unpaid invoice, a failed subscription payment, or unusual bank activity.
The message also contains a number to call if you want to respond immediately.
For many this seems like a step towards a solution and because it’s you who initiated the call it doesn’t feel unsolicited.
And then you are speaking directly with a cybercriminal who then moves to the next stage of the scam.
Now they can confirm your number is real and go through a script to try and obtain more information and other financial details.
The scam exploits typical human behaviour play the need to resolve an urgent unexpected change over the phone rather than going back and forth on email, text, or online chat.
Telstra’s research found that 69 per cent of Australians believe they couldn’t be tricked into contacting a scammer by phone, while 85 per cent say they prefer to resolve issues by picking up the phone.
This shift in tactics is encouraging victims to initiate the contact themselves.
Telstra has blocked more than a billion scam calls since 2020 but the callback scam gets around this.
Because you are calling back instead of receiving a call this also gets around the blocking.
Here are Telstra’s tips on avoiding becoming a victim of the callback scam:
– Find the number yourself
Don’t reply, click or call from the message. Always check the organisation’s official app or website for contact information.
– Check the source
Look for odd email addresses, unfamiliar mobile numbers or missing Sender IDs. If the source does not match the brand, do not trust the message.
– Check the claim before trying to fix it
Look at your bank account, subscription or order history before acting on the message.
– Keep security codes to yourself
One-time codes are designed to protect your account. A legitimate organisation should not ask you to provide one so it can “secure” or “cancel” something.
– Be wary of instructions to move money
A bank or other legitimate organisation will not ask you to transfer funds to a “safe account” or purchase gift cards or cryptocurrency.
– If in doubt, hang up
If someone discourages you from ending the call or checking independently, end the conversation.
– Report suspected scams
If you suspect a phishing scam, report it.
