👍 Good to know: the callback feature is available on the Simulation Premium plan, which also includes Smishing.
A callback attack contains no link. The email or SMS invites the employee to call a phone number; a Riot voice server answers. Real attackers use this pattern because trust builds faster over the phone, and because a message with no link gets past filters that analyse URLs.
1️⃣ Adding a callback template to a campaign
In the template catalogue, filter on the Callback type, then add the template to your campaign. You can mix callback templates with standard ones in the same campaign.
A callback template looks like any other, with two differences: the call to action is a phone number instead of a link, and email templates include a 6-digit verification code.
👍 Good to know: the verification code only exists for email templates. Over SMS, Riot already knows the employee's mobile number and identifies them automatically when they call back.
2️⃣ What happens when the employee calls back
👉 From an SMS
The calling number is recognised: the employee is immediately counted as caught, and Albert's remediation plays during the call.
👉 From an email
If the calling number matches the one known for that employee, they are caught immediately and remediation starts.
If the number isn't recognised, the employee has to enter the 6-digit code. Correct code: they are caught, and remediation starts.
👉 After three wrong codes
The call ends and the attack is still counted as unsuccessful. The employee does not appear as caught.
3️⃣ Remediation during the call
The remediation training plays automatically over the phone. It counts as complete if the employee stays on the line for more than 30 seconds. If they hang up before that, or if they weren't caught, they go back into the standard remediation journey.
4️⃣ What you see in the activity log
Four events appear in the activity tab of a callback attack:
the number was called;
the verification code was entered;
remediation started;
remediation completed.
👍 Good to know: calls are neither recorded nor transcribed. All you have is the timestamp of these events — there is no way to listen back to a call. That is a constraint to know about if you were thinking of using calls as review material, but it is also what makes the feature acceptable to your employee representative bodies.
5️⃣ Which number calls your employees
Riot picks a local number automatically, based on the employee's profile, in this order: their phone number's country code, then their time zone, then their language.
For templates impersonating a specific brand, a dedicated number is used per brand, so that the voice server announces the right service name before identifying the employee.
When an employee is targeted by several callback attacks, Riot rotates the numbers available for their country, so that each attack stays separately identifiable.
💡 Our recommendation: sync your employees' phone numbers in a clean format before launching a callback campaign. That is what improves routing accuracy the most, and what allows the employee to be identified without having to enter a code.
6️⃣ Availability and coverage
Callback attacks are enabled automatically for customers with the Smishing module.
Local numbers currently exist in France and the United Kingdom:
Belgium, Luxembourg, Monaco and the French overseas territories receive a call from a French number;
every other country receives a call from a UK number.
⚠️ Important: outside the countries covered by a local number, the foreign dialling code is a cue that some employees will spot. Bear that in mind when interpreting the results of a callback campaign on those populations.
7️⃣ What can't be customised
The audio script is shared across a given service, rather than being specific to each template.
The phone numbers belong to Riot: you can't use your own.
The number of code attempts (3) and the remediation completion threshold (30 seconds) are fixed.
8️⃣ One limitation to keep in mind
After two or three campaigns, your employees recognise the voice and the flow of the call. The real difficulty drops over time. Alternate templates and space out your callback campaigns to keep them worthwhile.
Key takeaways
No link: the employee is invited to call a number, and a voice server answers.
Over email, a 6-digit code identifies the employee if their number isn't recognised; three wrong attempts and the attack stays unsuccessful.
Remediation plays during the call, and counts as complete after 30 seconds on the line.
No call is recorded or transcribed.
Included with the Smishing module; local numbers in France and the UK.