An email tells you that you have a new voicemail waiting — from a missed call, a delivery, or your bank — and invites you to click to listen or download the message. It looks like a normal notification from your phone or email provider. But the attachment is malware and the link is a trap. Our GetMyPassword team explains how to recognize a voicemail phishing scam.
How the scam works
You receive an email or text claiming to be a voicemail notification — often styled to look like your phone carrier, a unified messaging service, or your email provider — saying a new message is waiting. To hear it, you must click a link or open an attached audio file. The link leads to a fake login page that captures your email or account password, while the “attachment” is actually malware that infects your device. The message preview may include a caller number and time to seem authentic. There is no voicemail; the notification exists only to make you click.
Red flags to watch for
- A voicemail “notification” by email for a service you do not use that way.
- An attachment to “play” the message, or a link to a login page.
- Urgency — an “important” message you must hear right away.
- A sender address that does not match your real carrier or provider.
- A request to log in to “access” the voicemail.
How real voicemail works
Your voicemail lives in your phone’s own dialer or your carrier’s official app, not as a clickable attachment from a stranger. If your carrier does email voicemail transcripts, you will know you set that up, and it will come from their real address. A genuine message never requires you to log in through an email link or open a downloaded file to hear it. When a “voicemail” arrives unexpectedly by email with an attachment or a login prompt, treat it as phishing and check your actual voicemail through your phone instead.
Real voicemail is in your phone, not in an email attachment from a stranger. A message you must log in or download a file to hear is not a voicemail — it is the hook.
How to protect yourself
Do not click links or open attachments in unexpected voicemail emails; check your actual voicemail through your phone’s dialer or your carrier’s official app. Never log in through a link to “access” a message, and keep your devices updated with reputable security software. If you clicked and entered your password, change it immediately and run a security scan. Protect your email and accounts with two-factor authentication and a unique password from our password generator, so a single click cannot hand over everything.
Frequently asked questions
Is a voicemail email notification a scam?
An unexpected voicemail “notification” by email with an attachment to play or a link to log in is a common phishing scam. Real voicemail is in your phone or your carrier’s official app, and never requires logging in through an email link to hear.
Why is the attachment dangerous?
The “audio” attachment is often malware that infects your device when opened, while the link leads to a fake login page that steals your password. Genuine voicemail never arrives as a file you must open from an unknown sender.
What if I clicked or opened the attachment?
Change your email and account passwords immediately, run a security scan to remove any malware, and turn on two-factor authentication. Watch your accounts for unusual activity and report the phishing message.