Tech Support Scam: Fake Orders and Bank Alerts Prompt Victims to Call

Our detections have uncovered messages impersonating retailers and financial institutions to persuade recipients to call a supposed support service. The scenarios vary, but they lead to the same action: calling a phone number included in the message.

Over a two-week period, from 18 September to 2 October 2026, our teams identified more than 150,000 messages and recorded over 40 callback numbers used in this campaign.

What Is a Tech Support Scam?

A tech support scam impersonates a legitimate support service to persuade someone to call, make a payment, disclose sensitive information, or authorize access to their device.

A Fake Order Designed to Prompt a Dispute

Several messages pose as purchase confirmations or invoices linked to well-known retailers, including Darty, BUT, and Cdiscount. They mention popular, high-priced products such as smartphones, gaming consoles, tablets, and gift cards. The purchase is described as approved, being prepared, or already paid for.

Recipients are told to contact customer service if they do not recognize the purchase. This instruction turns an unexpected invoice into a pretext for a phone call. Similar wording appears across multiple messages, even as the displayed identities and contact details change.

A Fake Bank Alert Creates Pressure to Call

Other messages imitate bank notifications. They refer to a login from a new device, sometimes with an unusual location, and then report a pending transfer or payment. The amounts shown run into the thousands of euros. Recipients are urged to contact support to verify or dispute the transaction.

These alerts combine several pressure tactics: fear of unauthorized access, the appearance of transaction monitoring, and the promise of a quick response. Familiar institution names and message details make the scenario seem plausible, but they do not authenticate the sender.

The Callback Number Provides a Common Lead

Based on our team’s checks, the callback numbers identified are associated with the Onoff service. This association helps correlate the messages we observed; by itself, it does not identify the users of the lines or attribute the campaign to Onoff. It provides a lead for linking messages that use different retailers, banks, or sending addresses. Display names such as “Customer Service,” “Bank,” or “Epay” do not always correspond to an official domain belonging to the impersonated organization.

We submitted several takedown requests to Onoff, which handled them promptly. However, despite several attempts, we were unable to reach its anti-fraud team.

The tactic redirects the recipient’s attention to a phone conversation with someone presented as able to cancel the transaction. This shift to fake support is what characterizes the scam: the fake order or bank alert is designed to trigger the call.

What the Phone Conversations Revealed

We called the numbers in question and spoke with several operators. They began by asking for the caller’s name, which they associated with the number calling them. This practice complicates an investigation: using the same disposable line under several identities could expose the calls, while a single line makes it difficult to contact multiple numbers for different scams.

The operators we heard had similar accents. This observation does not establish where they were from. In most calls, other conversations could be heard in the background, suggesting activity in a shared environment.

The operators asked us for the reference number of the transaction mentioned in the message. Once we provided it, they repeated details already shown, such as the amount, merchant, or supposed beneficiary, and followed a script consistent with the scenario we had received.

The operators then sent a file by MMS. We could not retrieve it or analyze its contents.

Observed Attack Chain

The observed chain starts with a message imitating a purchase confirmation or bank alert and asking the recipient to call the number provided. During the call, the operator asks for the caller’s name and the transaction reference, then repeats details from the message, such as the amount, merchant, or supposed beneficiary, to make the conversation credible. In the calls we examined, the operators then sent a file by MMS. We could not retrieve it, so its contents and role in the chain remain unknown. The steps below summarize what we observed and mark what we could not confirm.

Detection and Prevention Guidance

Security teams can look for a combination of an unusual transaction, a high amount, and an instruction to call back. Other useful signals include purchases of expensive electronics, login alerts from a new device, and messages claiming that a transfer is awaiting processing.

Normalize phone numbers by removing spaces, hyphens, and parentheses, then correlate them with message wording, displayed identities, and impersonated brands. This can reveal variants that do not share the same sending address.

Recipients should verify any transaction in their banking app or by using the retailer’s or bank’s official contact details, obtained independently. They should not call the number provided in the message.

Possible Motivation

The pretexts suggest that the most likely motivation is financial. The conversation may aim to persuade the victim to make a payment, disclose banking details or authentication codes, or take an action that grants access to their device. The file sent by MMS could extend this manipulation, but its role remains undetermined at this time.

Conclusion

The detections show two recurring pretexts, an unrecognized purchase and a suspicious transfer, that lead to the same phone solicitation. Correlating numbers associated with Onoff with message text and impersonated brands helps identify variants of this tech support scam.

In 2025, our team also tracked a cluster operating in the US market that involved legitimate platforms such as PayPal, Venmo, and Adobe Sign in tech support scam scenarios. The channels observed in that case differ from those described here, which rely on impersonating retailers and banks. Both cases show how familiar brands can make these solicitations more credible.

Indicators of Compromise (IOCs)

All numbers below are identified as malicious phone numbers in the source article.

Type	Value
Phone	0451459025
Phone	0159581731
Phone	0756862950
Phone	0189629302
Phone	0756837552
Phone	0259508016
Phone	0376379967
Phone	0189628128
Phone	0189628155
Phone	0189628478
Phone	0189628702
Phone	0189628757
Phone	0189628812
Phone	0189628868
Phone	0189629082
Phone	0189629102
Phone	0189629137
Phone	0189629227
Phone	0189629250
Phone	0189629312
Phone	0189629506
Phone	0189629537
Phone	0189629808
Phone	0189629830
Phone	0259508686
Phone	0259509004
Phone	0259509101
Phone	0259509429
Phone	0259509674
Phone	0259509877
Phone	0392239204
Phone	0537078189
Phone	0537078321
Phone	0644693987
Phone	0756814003
Phone	0756830468
Phone	0756861942
Phone	0756895565
Phone	0756990631
Phone	0780941108
Phone	0780943122
Phone	0189628996
Phone	0392239150
Phone	0537078998