Scammers Exploit Disposable VoIP Numbers to Bypass Reputation Blocking

Cisco Talos reports that scammers increasingly embed VoIP phone numbers in phishing emails (telephone-oriented attack delivery, TOAD), abusing CPaaS and VoIP providers to provision disposable numbers at scale; researchers observed 1,652 unique numbers across major campaigns (Feb–Mar 2026), short lifespans (median ~14 days), reuse and rotation tactics, and recommend tracking phone numbers as IOCs and improving real‑time telephony reputation sharing to disrupt these fraud operations.