You Have a New Voicemail!

Protect yourself

Access voicemail through your normal phone or voicemail system, not an unexpected email link.

How it works

An email says you missed an important phone call and must click a link or open an attachment to listen to your voicemail.

The attachment is usually an HTML file that opens a fake Microsoft login in your browser. Because it's a local file, URL filters never see it.

Red flags

An HTML or "audio" attachment you have to open to listen
A voicemail notification from a system your company doesn't use
A caller ID in the subject line to make it feel specific

If it already happened

If you already clicked and signed in: change that password now, from the real site, and turn on multi-factor authentication. If you sent money, call your bank immediately; wire and ACH recalls work best in the first hours. Tell your IT provider so they can check for forwarding rules and other sign-ins on the account.

Where OpenEFA fits

OpenEFA MailGuard blocks most of these before they reach an inbox. The ones that get through are usually the most carefully targeted, which is why your people still need to know the pattern.

Scam Watch No. 15 · EFA Security · efasecurity.com/scam-watch/ · Print this page and post it where your team will see it.

No. 14: Your Direct Deposit Information Needs Updating No. 16: Scan This QR Code to Verify Your Account

Part of the OpenEFA MailGuard Scam Watch series. Published October 21, 2026 by the EFA Security team. Share it freely; a link back is appreciated.

At a glance

Type: Email Phishing
Channel: Email Scams (Phishing)
They want: Your password, or a payment
One rule: Your real voicemail doesn't arrive as an attachment.

Post it in the breakroom

This page prints as a one-sheet poster with no menus or sidebars.

Print this alert

Get these by email

One short alert when something needs your attention. No marketing, one-click unsubscribe.

All 24 alerts

Phone, email and text message scams, each on one page.

Scam Watch index