Toll-free 'account suspended' voicemails: how to check the callback number

Short version: put the phone down, don't dial the number in the voicemail, and run the six steps below. It takes about five minutes, and none of it touches the number the recording gave you.

What the recording sounds like

The wording changes, but the shape doesn't. Here is a composite, written by me, of the kind of message people describe:

"This is an important notice regarding your account. Your account has been suspended due to unusual activity. To restore access, you must call us back within twenty-four hours at the toll-free number we will now repeat. Press 1 to speak with an agent."

Two tells are worth learning. The first is vagueness. A real fraud team knows which account it's calling about, and it names the company in the first sentence, gives a department and tells you that you can verify the call by dialing the number on the back of your card. A recording that says "your account" without naming anything is a net cast over thousands of phones at once. The second is the deadline. Real companies do send urgent notices, but a missed payment doesn't normally turn into an arrest, a seizure or a permanent closure within 48 hours. Short deadlines exist to stop you from doing the slow, boring thing that would expose the call, which is checking.

Why a toll-free number is in the message

Because toll-free numbers look like customer service lines, and a worried person is looking for exactly that. Anyone can reserve a number in the 800, 833, 844, 855, 866, 877 or 888 range through a provider, and a recording can be pointed at it within minutes. The prefix tells you the callee pays for the call. It says nothing about who the callee is. The whole family is laid out in the briefing on 833 and the other toll-free codes.

Dial that number and one of three things happens. A person who sounds professional asks you to "verify your identity" with a card number, a PIN, the last four digits of a Social Security number or a code that was just texted to you. Or you reach a menu asking you to press 1 or 2, which feeds a list of numbers that answer. Or you get silence, which still tells them your line is live. The call back is the step the scheme was built to get.

Six steps, in order

1. Write it down. Note the number that called, the exact company name the voice used (if any), the date and time, and the deadline it gave. Don't delete the voicemail yet.

   What you'll see: the voicemail entry on your phone, likely from a number you haven't saved and possibly with a transcript under it.

2. Leave the number alone. Don't call it, and don't tap a link in any text that arrived with it. Close the voicemail.

   What you'll see: nothing happens, which is the point.

3. Open the real site or app. Type the company's website address yourself or open its official app. Don't go through a search ad, since ads are the easiest place to plant a fake number.

   What you'll see: the company's own login page, with the address you typed in the address bar.

4. Log in the normal way. If your account is fine, the dashboard shows no suspension, and that is usually the whole answer.

   What you'll see: your normal account page. A genuine suspension shows up here as a banner or an alert, not only in a voicemail.

5. If something odd shows up, call the number you trust. Use the support number printed on your card, your paper statement or the site's contact page, and ask the agent about the voicemail. Quote the time it arrived.

   What you'll see: a menu or an agent who can look at your account. A real one answers in specifics.

6. Compare the numbers. Set the number in the voicemail beside the number on the official site. A mismatch isn't proof of fraud, since companies run many lines, but it means you ask the main line before you share anything. The cheat sheet on finding a company's real toll-free number shows where to look.

   What you'll see: either a match, which is mildly reassuring, or two different numbers, which is a reason to keep asking on the one you trust.

The slower, general version of this routine is in the Q&A on verifying a toll-free caller. This page covers the narrower case where there's a recording and a deadline.

If something went wrong along the way

It happens, and the useful response is fast and specific. Find your situation below.

• I pressed 1 or 2. Pressing a key doesn't authorize a charge or "accept" anything legally, because a phone menu is just a menu. What it can do is tell the calling system that a live person picked up. Numbers that respond tend to get called again and may be passed along, which is a reasonable guess about how call lists work and not a documented fact about any one campaign. Hang up, block the number and expect calls from others. Pressing a key to opt out rarely works on recorded calls from unknown senders, and a scammer treats it as confirmation that the line is active.
• I called back but gave nothing. Hang up, block the number and carry on.
• I gave a card number or bank login. Call the bank on the number on the card, tell them what happened, and ask them to lock or replace the card and review recent activity.
• I read out a one-time code. Treat that account as compromised. Change its password from the real site and check where it's signed in.
• I gave my Social Security number or birth date. Visit the FTC's identity theft site and follow the recovery steps for your case. Consider a credit freeze.
• I let them onto my computer. Turn off the internet connection, uninstall the remote tool and get the machine checked before you log in to anything.

Whatever you did, report it. ReportFraud.ftc.gov takes a few minutes, and the FCC accepts complaints about robocalls and spoofing at fcc.gov/consumers. Neither agency can usually recover your money or stop the number personally, but the reports feed investigations and pattern analysis. Telling the real company matters more, because only they can lock the account and flag the activity.

If the voicemail turns out to be real

Sometimes it is. Banks do call about suspicious charges and phone companies do send notices about payment problems. A real one names the company in the first sentence, refers to something specific you can verify such as a recent transaction, and never asks you to read out a full card number or a PIN. It also holds up under the slow route: log in, find the notice or call the number on your card, and the same issue is waiting. Treat the cost of being wrong as lopsided. If the voicemail is real and you spend ten minutes verifying, nothing breaks. If it's fake and you act on it, you can lose real money.

Cut down on the next one

• On iPhone, go to Settings > Phone > Silence Unknown Callers. Unknown numbers go to voicemail and show in Recents, so you can look before you listen.
• On Android's Google Phone app, tap the three dots, then Settings, then Caller ID & spam, and turn on the spam filter.
• Forward suspicious texts to 7726 so your carrier can learn from them.
• Add your number to the Do Not Call Registry at donotcall.gov or by calling 1-888-382-1222. It limits legal telemarketers, and I'd rather say up front that it won't touch criminals.

Expect each blocked number to be replaced by another, since campaigns rotate numbers. Blocking is housekeeping, not a cure, and the check above is what actually protects you. If the voicemail was about coverage or benefits, the myth-by-myth page on Medicare, insurance and warranty calls is the next stop.

Sources

• FTC Consumer Advice: guidance on phone scams, imposter calls and what to do if you shared information.
• ReportFraud.ftc.gov: where to file a scam report.
• FCC Consumer resources: robocalls, spoofing and call authentication.