High Severity

Service Abuse: American Express callback scam

Labels

Callback Phishing
Impersonation: Brand
Social engineering
Natural Language Understanding
Content analysis
Sender analysis

Description

Messages spoofing American Express notification emails about a complimentary signs and supplies order, designed to lure recipients into calling a listed phone number. The rule parses the greeting line in the message body and runs it through a natural language classifier to confirm the content matches known callback scam intent patterns.

References

No references.

Sublime Security
Created Oct 6th, 2026 • Last updated Oct 6th, 2026
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and sender.email.domain.root_domain == "americanexpress.com"
and any(regex.iextract(body.current_thread.text, 'Hello, (?P<name>[^\n]+)\n'),
        any(ml.nlu_classifier(.named_groups['name']).intents,
            .name == "callback_scam"
        )
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started
Deploy and integrate a free Sublime instance in minutes.
Get Started