Scam library · Email & phishing · Small business
Voicemail audio message phishing
'You have a new voicemail (00:42).' The email includes a play button or an attached HTML file. Clicking opens a page asking you to sign in with your email account to listen.
There's no voicemail. The page steals your login.
Treat any voicemail email that asks for your password as phishing until proven otherwise.
What the message looks like
From: Voice Mail System <voicemail@vm-notify-services[.]net>
Subject: New voicemail from (617) 555-0124
You have received a new voicemail (00:42).
Open the attached file to listen. Sign in may be required.
How this scam works
Voicemail phishing targets businesses that use phone systems linked to email. Messages often include a caller number, duration and a time stamp to look real.
Attachments may be HTML files that open fake sign-in pages directly in your browser, avoiding link filters.
Some use QR codes to send you to a phishing page on your phone, where it's harder to see the URL.
Real voicemail systems usually attach audio files or link to your phone system's portal, and don't ask for your email password to play a message.
If you weren't expecting a voicemail, check your phone system directly.
Report suspicious voicemail emails to your IT team, who may see the same messages hitting coworkers.
The fake sign-in page may already show your email address, making it look like a real session. Some pages show a loading bar or fake audio player before asking you to log in.
Scammers send these emails to many people at the same company at once, hoping at least one person signs in. If you get one, tell IT so they can warn others.
Once attackers get into one account, they can send phishing from it to coworkers, customers and vendors, who are more likely to trust a message from someone they know.
Red flags
- Voicemail emails with HTML attachments.
- Requests to sign in to listen.
- QR codes to play messages.
- Senders that aren't your phone system.
- Unexpected voicemails.
- A fake audio player or loading bar before a sign-in page.
How to tell it’s fake
- Check your phone system directly.
- Look at the attachment type.
- Ask IT if unsure.
- Never sign in from an email to listen to a message.
- Check your phone or voicemail app to see whether the message actually exists before opening anything.
What to do if you clicked, paid or shared info
Don’t panic, and don’t blame yourself. These scams are built by professionals. Act quickly, one step at a time.
If you clicked a link or called back
- Don't open attachments. Report the email.
If you paid
- If you were asked to pay, don't.
If you shared personal info, a password or a code
- If you entered your password, change it and tell IT.
Where to report and get help (U.S.)
If a message seems legit and you’re still not sure, get a second opinion before you act. Reporting helps stop scammers, even if money can’t be recovered. If you are in danger, call 911.
- Your bank or card issuer
Call the number on the back of your card or on your statement, not one from the message. Ask them to stop or reverse the payment and to watch the account. - Federal Trade Commission (FTC) · ReportFraud.ftc.gov
Report the scam and get a step-by-step recovery plan. - FBI Internet Crime Complaint Center (IC3) · ic3.gov
Report scams that happened online, especially if money was lost. Include phone numbers, websites and payment details. - AARP Fraud Watch Network Helpline · aarp.org helpline
Free, for anyone of any age: trained volunteers help you sort out next steps. 877-908-3360, Monday to Friday, 8 a.m. to 8 p.m. Eastern. - IdentityTheft.gov · IdentityTheft.gov
If you shared your Social Security number or someone opened accounts in your name.
How Gmork Scam Guard would warn you
Scam Guard in Chrome and Edge on your computer checks voicemail emails and the pages they open. It recognizes fake sign-in pages and HTML attachment tricks. If a voicemail seems legit, a scam expert can check it.
Scam Guard can miss things, so the checks above still matter. See what it warns about and what it keeps private.
Questions people ask
- Do voicemails require sign-in?
- Not usually with your email password.
- What are HTML attachments?
- Files that open web pages in your browser, often phishing.
- Why use QR codes?
- Phone screens make URLs harder to check.
- What do I do if I signed in?
- Change your password and tell IT.
- What if it shows my email already filled in?
- That's easy to fake. It doesn't mean the page is real.