Service Abuse: American Express callback scam

calendar Oct 6, 2026  ·
Share on: linkedin copy

Messages spoofing American Express notification emails about a complimentary signs and supplies order, designed to lure recipients into calling a listed phone number. The rule parses the greeting line in the message body and runs it through a natural language classifier to confirm the content matches known callback scam intent patterns.

Sublime rule (View on GitHub)

 1name: "Service Abuse: American Express callback scam"
 2description: "Messages spoofing American Express notification emails about a complimentary signs and supplies order, designed to lure recipients into calling a listed phone number. The rule parses the greeting line in the message body and runs it through a natural language classifier to confirm the content matches known callback scam intent patterns."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and sender.email.domain.root_domain == "americanexpress.com"
 8  and any(regex.iextract(body.current_thread.text, 'Hello, (?P<name>[^\n]+)\n'),
 9          any(ml.nlu_classifier(.named_groups['name']).intents,
10              .name == "callback_scam"
11          )
12  )  
13attack_types:
14  - "Callback Phishing"
15tactics_and_techniques:
16  - "Impersonation: Brand"
17  - "Social engineering"
18detection_methods:
19  - "Natural Language Understanding"
20  - "Content analysis"
21  - "Sender analysis"
22id: "c43f2cd1-216e-5391-b6e9-2b89c5ead1fc"
to-top