Australian consumer and cyber agencies are warning that callback phishing scams are increasingly arriving as calendar invitations, with criminals impersonating PayPal and other trusted brands to trick recipients into dialing fraudulent support numbers.
No link, just urgency
Unlike traditional phishing emails that hide malware in attachments, callback—or telephone-oriented attack delivery—lures use fake invoices or auto-renewal notices to create anxiety. Victims call a number printed in the message, where a live scammer persuades them to install remote-access software or disclose banking credentials.
Riley Paterson reports that security researchers have documented cases where the lure arrived as a Google Calendar event from a compromised account, warning that a PayPal payment of about $600 would process within 12 hours unless cancelled by phone. Calendar delivery can bypass email filters tuned for bulk spam.
Brands in the crosshairs
The Australian Competition and Consumer Commission’s Scamwatch service has previously highlighted fake purchase alerts referencing PayPal, Microsoft, Norton and McAfee, with claimed transaction amounts often between $300 and $2,000—high enough to panic, low enough to sound plausible.
The Australian Signals Directorate’s Australian Cyber Security Centre separately continues to warn that criminals impersonate government cyber agencies themselves, using official logos to sell bogus antivirus tools. Businesses should route any unexpected “ACSC” call through the published national hotline on 1300 CYBER1 (1300 292 371), not alternate numbers supplied by callers.
Why October matters
October is Cyber Security Action Month, and major banks including ANZ have used the calendar to urge small businesses to rehearse payment-redirection drills. Invoice fraud and business-email compromise remain among the costliest scam categories in the ASD’s annual threat report, with more than 84,000 cybercrime reports lodged in the prior financial year.
Paterson advises finance teams to treat any change to supplier bank details as a stop-the-line event requiring voice verification on known numbers. IT desks should block unsigned calendar invites from external tenants where policy allows, and train staff that legitimate vendors never demand remote-access installs during a first support call.
Recovery and reporting
Victims who install remote-access tools should disconnect from the internet, rotate passwords from a clean device, and contact their bank immediately. Reports can be filed with Scamwatch and, for significant business losses, with ReportCyber.
The calendar-invite twist is a reminder that scammers follow users into collaboration platforms as eagerly as they follow them into email—especially when cost-of-living stress makes a fake $599 charge feel frighteningly real.