Callback scams: the phone number on that invoice may be the trap

An invoice arrives for something you did not buy. It gives you a number to call if the charge is wrong. Picking up the phone feels like the sensible way to sort it out—but the number can be the scam. Telstra highlighted that pattern in a new warning on 24 September.

The trick is to make you start the conversation

Scamwatch describes fake purchase messages delivered through email, text, app notifications and calendar invitations. The alleged purchase and a short cancellation deadline create the pressure. Once someone calls, the scammer may ask for payment details or remote access, or invent a refund problem that supposedly requires money to be sent back.

The first message does not have to persuade you to pay. It only has to persuade you that a call is urgent. That is why advice to avoid suspicious links is useful but incomplete: there may be no link to click. The phone number can perform the same job.

What Telstra’s new figures do—and do not—show

Telstra says callback scams accounted for about 29% of its reported email scams in 2025 and 45% in 2026 so far. That is a change in the mix of reports it receives. It does not mean 45% of all Australian scams use this method, or that 45% of people lose money to it.

Separately, a YouGov survey commissioned by Telstra found 69% felt confident they could not be tricked into phoning a scammer, while 85% preferred a phone conversation when urgently dealing with an unexpected charge. The online survey covered 1,058 Australian adults from 7 to 9 September. These are reported attitudes, not results from testing whether participants would spot a real scam.

Check the charge without following the message

For a subscription, look in the account’s billing or purchase history. For a claimed bank charge, look in the banking app you normally use. Do not use the message itself as proof that the charge happened. If there is a transaction you do not recognise, contact the provider or bank through its genuine channel.

A useful household habit is to save the genuine contact route for services you use regularly before there is a problem. An urgent message is a poor moment to decide whether a phone number looks official. A familiar logo, your name or some correct account information should not replace an independent check.

For suspicious texts: what an “Unverified” SMS sender label means

If you have already called

End the call if you are being rushed or discouraged from checking elsewhere. If you shared bank details or sent money, contact your bank immediately through its official channel and explain what happened. Scamwatch points people to IDCARE for free identity and cyber support to make a recovery plan. Be wary of anyone who subsequently promises to recover lost money for you.

Write down what you actually shared: a card number, a password, a one-time code, a downloaded app or a transfer. That gives the bank or support person a clearer starting point than “I clicked something”. Keep the original message and any transaction details for your report; do not go back to the caller to ask how to undo it.

Being targeted is not a test of intelligence. The tactic is designed to catch someone when an unexpected bill is inconvenient and a quick call seems reasonable. The practical defence is to pause long enough to choose your own route to the organisation.