Fake Aircall / Dialpad / OpenPhone VoIP business phone subscription payment failed, business phone system offline, customer calls not received, or call routing and phone numbers suspended phishing
fake-aircall-dialpad-voip-business-calling-billing-phish
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Phishing emails impersonating Aircall, Dialpad, or OpenPhone claiming the VoIP business phone subscription payment has failed, the business phone system is offline, customer calls are no longer being received, call routing is suspended, or phone numbers are at risk — directing them to update billing or restore the phone system through a credential-harvesting portal. A distinct attack category targeting cloud VoIP and business calling platforms that replace traditional PBX systems. Key facts: (1) Aircall serves 15,000+ customers ($30-50/user/month Essential/Professional) as the dominant cloud phone system for sales and customer support teams — Aircall integrates directly with HubSpot, Salesforce, Zendesk, and Intercom, meaning Aircall credentials give attackers access to linked CRM call logs, contact records, and support ticket history in addition to the phone system itself; a 'your Aircall business phone system is offline' email creates immediate panic for any company running inbound sales calls or customer support through the platform; (2) The 'customer calls are not being received' hook is the highest-urgency possible for a phone system: unlike most SaaS tools where suspension means features are unavailable, a phone system suspension means customers calling the company's published support number hear a disconnection tone or busy signal — customer-visible failure with immediate revenue and reputation impact; (3) Dialpad serves 30,000+ customers ($15-25/user/month Standard/Pro/Enterprise) with particular strength in AI-powered call transcription and coaching — Dialpad's AI Voice Intelligence transcribes and analyzes every business call in real time; Dialpad subscription suspension stops all call transcription, disables the virtual assistant answering flows, and takes business phone numbers offline; (4) OpenPhone serves 50,000+ businesses ($13-25/user/month Starter/Business) as the leading VoIP platform for startups and small businesses — OpenPhone is often the first phone system for YC-backed startups; a suspended business number for a startup means every inbound customer, investor, and partner call goes to a disconnected number; (5) Aircall, Dialpad, and OpenPhone credentials expose all call recordings (which may contain sensitive customer conversations, support discussions, and sales negotiation details), voicemail transcriptions, call analytics, and the full contact directory with associated CRM data. Warning signs: sender not aircall.io/dialpad.com/openphone.com; genuine Aircall billing at dashboard.aircall.io/billing; Dialpad billing at dialpad.com/billing.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits over 1,800 signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 1,800+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started