Fake 'helpline' numbers planted in real Dell and Staples order emails drive callback scams, Talos says

What happened

GBHackers reported on 22 October 2026 on Cisco Talos research into two callback-phishing campaigns that abused legitimate Staples and Dell order-notification emails; Talos observed roughly 1,400 messages across the two campaigns. In the Staples campaign, an order confirmation describing an Apple iPad purchase (order #9939818875) contained 'Helpline 806 283 7712' and 'Order Confirmed' in fields normally reserved for shipping or billing information. In the Dell campaign, an order notification (Purchase ID 2009829958247) for Microsoft Project Standard 2024 totalling $736.09 showed 'Helpline 808 232 6397', 'Confirmed Order' and 'Call Our Sales Team' in its 'Ship To' and 'Bill To' sections. According to the report, the messages came through the retailers' real order-notification systems and passed DKIM/DMARC checks, so the sender addresses themselves were genuine; the attacker-controlled part was the inserted phone numbers. The goal was to alarm recipients about an unexpected high-value purchase so they would phone the number rather than investigate, moving them to a voice call where scammers could potentially pursue payment fraud, credential theft or remote-assistance scams (GBHackers notes the findings do not establish which follow-on actions occurred). Recipients should verify unexpected purchases by logging in to their retailer account independently or using established support channels, never a phone number supplied in a suspicious notification.

How the scam works

The scheme abuses a weakness in automated notification systems rather than faking a sender. According to GBHackers' account of the Talos research, attackers enter their own text into fields that a platform later copies into its emails, such as a name, company, address or project title. When the platform sends its usual order confirmation, the inserted 'helpline' number arrives inside a genuine, authenticated email, so spam filters and recipients see a message that really comes from the retailer.

Talos says it has tracked similar abuse of more than 25 legitimate platforms over the past year, covering collaboration, file-sharing, survey, payment and AI services, and has also seen lures hidden in delivery-failure notices. Passing DKIM and DMARC checks shows only that the email came from the company's systems; it says nothing about whether the purchase or the phone number is real. Dell and Staples are not the operators: their order systems were misused, and the numbers belong to the scammers.

Source

GBHackers, "Scammers Exploit Dell and Staples Order Emails to Bypass Traditional Phishing Detection" (published 22 October 2026).