Fake Voicemail and Fax Notification Emails
"You have a new voicemail" emails with a play button or attachment often lead to fake sign-in pages. How voicemail and fax phishing works and how to check a real message.
"You have a new voicemail (0:42). Click to listen." Voicemail and fax notifications feel routine at work and create curiosity: who called? Phishers use them to lead people to a fake sign-in page "to access the message".
Common versions
- "New voicemail from +1 (XXX) XXX-XXXX" with a play button.
- An attachment named "Audio_Message.html" or "VM_0042.htm". See HTML attachment phishing.
- "You have received a fax" with a document link.
- A QR code "to listen on your phone". See QR code phishing.
How to check
- Listen to voicemails through your phone, desk phone or the official phone system app.
- Compare with what genuine notifications from your system look like.
- Ask IT if you are unsure how voicemails are delivered.
If you do not use email voicemail at work, any such email is fake.
Got a voicemail email? Paste it into CyberWatch AI Scan for a free check.
For more, see how phishing works in our complete guide.
Frequently asked questions
Does my company's phone system email voicemails?
Some do. Check what a genuine notification from your system looks like, and listen to voicemails through the phone system or app itself.
Why ask me to sign in to hear a voicemail?
That is the trap. The sign-in page captures your password.
Are audio attachments dangerous?
Real audio files are lower risk, but phishing often uses HTML files or links disguised as audio.
Sources
- Suspicious email actions, UK National Cyber Security Centre
- Recognize and Report Phishing, US Cybersecurity and Infrastructure Security Agency
- How To Recognize and Avoid Phishing Scams, US Federal Trade Commission
