You missed a call from a number you don’t know, and now there’s a voicemail. A calm, official voice says your bank account will be frozen, or a warrant has been issued, or a $1,299 laptop is about to ship to an address you’ve never heard of. Please call back today at the number below.
That last sentence is the whole point of the message. Everything before it exists to make you dial.
A recording does the scammer’s hardest work
A live call is risky for a scammer. You might ask a question they can’t answer, or hang up in the first five seconds. A recording removes both problems. The script is polished once and delivered word for word to thousands of people, including the many who no longer answer unknown numbers and the ones whose phones send every unrecognized caller straight to voicemail.
It also flips the direction of the call. When you dial back, you are the one who reached out. You arrive worried, half-convinced, and ready to fix the problem. The FCC put it plainly in its warning about voicemail call-back scams: “A scammer’s first goal is to engage you.”
The Canadian government’s Get Cyber Safe program calls this vishing, short for “voice phishing,” and describes the setup in one line: “Vishers spoof their caller ID and call their victims with a prepared voicemail for a callback.”
Phone scams cost more than most. According to FTC data for 2025, scams that started with a phone call led to 290,427 reports and $1.108 billion in reported losses, with a median loss of $1,835. That is the highest median among the main contact methods, well above the $1,000 median for text scams.
Five recordings, and the line that gives each away
The wording changes every few months. The structures don’t. These five are written the way you might hear them; all the numbers are fictional.
The legal department that names no court
“This message is intended for you. This is the legal department. A motion is being filed to suspend all bank accounts and tax returns bearing your name. To avoid legal action, call us back immediately at (202) 555-0139.”
This is close to an example the FCC itself quoted. There is no agency, no court and no case number, and the threat makes no legal sense. Courts and tax agencies write to you.
A fraud alert that never says which bank
“This is the fraud prevention department calling about suspicious activity on your debit card. A charge of $849 is pending. If you did not authorize this charge, call our verification line at (312) 555-0176 within the next two hours.”
Your own bank knows its own name. This message never says it, and the “verification line” is not the number printed on your card. Many banks send fraud alerts by text or app notification and ask you to confirm a charge, rather than asking you to ring a new number.
The laptop you didn’t order
“Hello, this is an automated message about your recent order of an Apple MacBook for $1,299. If you did not place this order, press 1 or call (646) 555-0112 to cancel.”
It works precisely because you have no such order. The “cancellation” call turns into a request for card details or remote access to your computer, which is how refund and tech support scams begin.
Benefits about to be “stopped”
“Your Social Security number has been suspended due to suspicious activity. Call the enforcement division at (469) 555-0158 before your benefits are stopped.”
Social Security will never suspend your number, threaten you, or demand payment by gift card, wire or crypto. The same template is reused for Medicare cards, utility shut-offs and, in Canada, the CRA.
“It’s me, call this number instead”
“Hi, it’s me. I’m in trouble and I can’t talk long. Please call me back at this number, not my regular phone. Don’t tell Mom.”
A new number, a plea for secrecy, and no name. With AI cloning, the voice may even sound like someone you love. The FCC confirmed in February 2024 that AI-generated voices in robocalls count as “artificial” voices under the TCPA. Families who agree on a code word in advance are much harder to fool with cloned-voice emergency calls.
Listening for what the message leaves out
You don’t need to recognize a specific script. A handful of questions will sort most messages.
First, compare the number in the message with the number on your caller ID. Scammers often spoof the caller ID to look local or official, then read out a different callback number. A real organization usually calls from its published number and asks you to call that same number back.
Second, notice whether it names you and the organization. “Your account” and “your order” are vague on purpose, so one recording works on everybody. Your pharmacy says your name and its own.
Third, listen for the clock. “Within two hours,” “final notice” and “legal action” are pressure, not information. An instruction to press 1 is another giveaway; it connects you to a live scammer and confirms that your number is answered.
Finally, the voice. Get Cyber Safe lists “poor audio quality, a robotic tone or an unnatural rhythm in the caller’s speech” as signs of vishing. Newer synthetic voices can sound perfectly human, though, so a natural voice proves nothing.
Real messages exist, of course. A clinic confirming an appointment, a pharmacy saying a prescription is ready, a courier stuck at your gate. They tend to be specific and unhurried, and nobody minds if you call the main number you already have.
Messages that arrive without a ring
Some voicemails appear even though your phone never rang. That’s “ringless voicemail”: a system drops a recording straight into your mailbox, and you never get the chance to decline the call.
In a 2022 declaratory ruling (FCC 22-85), the FCC found that ringless voicemail to wireless phones requires consumer consent “because it is a ‘call’ made using an artificial or prerecorded voice,” which places it under the Telephone Consumer Protection Act. Together with the TCPA’s general limits on prerecorded calls to mobiles, an unsolicited recorded sales message on your cell phone is generally not allowed without your consent. Scammers ignore the rule, but it draws a clear line for legitimate companies and gives you grounds to complain. The wider TCPA and Do Not Call rules explain what consent means in practice. This is general information, not legal advice; check the FCC’s rules or a lawyer for a specific case.
Thirty seconds with the callback number
If you still feel the pull to call back, look up both numbers first: the one on your caller ID and the one read out in the message.
Start with the number type and region. A FreeSpy lookup shows whether a number is geographic, toll-free, premium or Caribbean +1 international. A “local” bank asking you to ring an 876 or 809 number is not local at all, and the call may be billed at international rates, the same trick behind one-ring Caribbean callbacks.
Then read the reports. Community reports and FTC complaint data often describe the identical script. If several people wrote “voicemail, said my SSN was suspended,” you have your answer.
Last, put the callback number next to the one on your card, your bill or the organization’s own website. If they don’t match, don’t dial it. And remember that a match on caller ID alone is not proof, because spoofed calls can display a bank’s real number.
Things not to do with a suspicious message
- Don’t call the number in the message. Get Cyber Safe’s advice is direct: “Don’t use your phone’s callback function or phone numbers provided by the caller to communicate.”
- Don’t return the call from your call log either. That number may be spoofed, or an expensive international line.
- Don’t press a key if the message, or a follow-up robocall, asks you to.
- Don’t call back just to tell them to stop. It confirms your number is live and puts you in front of a trained talker.
- Don’t give codes or personal details if you do end up speaking to someone. No real bank, agency or company needs your one-time passcode.
Listening, by the way, is harmless. An audio message can’t install anything or give anyone access to your phone. The risk begins when you call, press or share.
Handling it in six steps
- Listen once and take notes. Write down the callback number, the organization named and what they wanted. You’ll need it for a report.
- Find the real number yourself from the back of your card, a statement, the official app or a website address you type.
- Call that number and ask whether anything is wrong with your account. If the message was real, they’ll know.
- Report it. In the US, to the FTC at ReportFraud.ftc.gov or the FCC at fcc.gov/complaints. In Canada, to the Canadian Anti-Fraud Centre at 1-888-495-8501.
- Warn the next person. A number report with the call type set to “voicemail” and a one-line summary of the message helps others who look it up.
- Delete and block, knowing that scammers rotate numbers often.
Your own mailbox is a target too
Voicemail isn’t only a delivery channel for scams. The FCC warns that hackers break into voicemail systems to “gain access to your financial and social media accounts by intercepting two factor account verification codes” that some services deliver by voice call. Others hijack a mailbox and change the outgoing greeting.
The FCC’s advice: change the default password on every voicemail box you use, at home, at work and on your mobile. Pick a voicemail password of at least six digits, and avoid your address, birth date, phone number or repeating digits. If you have never changed your PIN, your carrier’s voicemail settings are the place to do it today.
Your phone can help with the rest. Voicemail transcription lets you read a message instead of sitting through the pitch, and built-in spam filtering moves many of these calls into a separate folder before you ever see them.
If you did call back and shared something, contact the real organization through its official number straight away, change any passwords you gave out, and file the reports above. Names and partial card numbers that a caller recited are not proof of anything; that information circulates in data breaches and marketing lists.
Sources
- FCC: Exposing voicemail call-back scams
- Get Cyber Safe: What is vishing?
- FCC: Ringless voicemails and robocalling rules (FCC 22-85)
- FCC: Voicemail hacking
- Summary of FTC Consumer Sentinel data for 2025