Callback Phishing: How Hackers Use PDFs to Steal Your Data
This New PDF Scam is Getting Everyone (Even Tech-Savvy People)
Look, I've seen a lot of clever scams in my time helping folks with cybersecurity, but this new callback phishing thing using PDFs? It's sneaky. Like, "even-my-IT-friends-are-getting-fooled" sneaky.
Here's what happened to my colleague last week: She got what looked like a totally legit PDF invoice from Microsoft. When she opened it, there was this "urgent" message about her subscription with a phone number to call. Being careful, she actually did call - and the person on the other end sounded 100% professional. Almost got her credit card info before she realized something was off.
Why This Scam is Actually Pretty Brilliant (Unfortunately)
These scammers are playing a different game. Instead of sending sketchy links or asking you to download stuff, they're using something we all trust: PDF files and good old-fashioned phone calls. It's like the digital equivalent of a wolf wearing really convincing sheep's clothing.
They're impersonating brands we all use - Microsoft, Adobe, even Amazon. And honestly? Their fake PDFs look incredible. I'm talking perfect logos, formatting, the whole nine yards. Some even include QR codes that lead to super convincing fake websites. (This is why I'm glad I started using Surfshark's antivirus last year - it catches a lot of these before they even hit my inbox.)
Here's Why It Works So Well
Think about it:
PDFs feel safe - we open them all day long
Phone calls feel more legit than suspicious links
When we're worried about our subscriptions or accounts, we want to fix things fast
The scammers sound professional and have all your info ready
How to Spot These Scams (Before It's Too Late)
First off, I always tell my family: if you get any PDF about your account or subscription, don't use contact info from the PDF itself. Instead:
Go directly to the company's website (type it yourself, don't click links)
Look up their official contact number
Check your actual account or subscription status while you're there
I've started using NordPass to keep track of all my subscriptions and account logins. Makes it super easy to check if there's actually an issue without falling for these scams.
Extra Protection That Actually Helps
Here's what I've set up for myself and my family:
A solid antivirus that checks attachments (I use Surfshark because it catches this stuff without being annoying)
A VPN to add an extra layer when checking accounts (big fan of NordVPN for this)
A password manager to keep track of which accounts I actually have
The "I'm Too Busy for This" Quick Checklist
Look, I get it - you've got stuff to do. Here's the bare minimum:
Never call numbers from PDFs - look up the company's number yourself
If someone calls you about your account, hang up and call back using the official number
When in doubt, check your account directly on the company's website
Keep your antivirus updated (seriously, it helps with these PDF scams)
Remember: If something feels off, even a little bit, trust that feeling. I'd rather spend an extra 5 minutes checking something out than spend hours trying to recover a hacked account or calling my bank about fraud charges.
Quick heads up:Some links in this article are affiliate links. If you buy something through them, we might earn a small commission (doesn't cost you extra). We only recommend stuff we'd actually use ourselves or set up for our own families. No BS recommendations here.
