If you have a RingCentral voicemail notification in front of you and something feels off, check the link before you play the message. Fake voicemail notifications are one of the most effective phishing formats in use, because a voicemail is genuinely worth opening and the format gives you an obvious thing to click.
We first warned clients about this in 2019. It is still circulating, and the fakes are better now.
Why voicemail notifications work so well for attackers
A voicemail alert carries built-in urgency — somebody called and you missed it. It arrives at a predictable time of day, it is normal in every business that uses hosted telephony, and the natural response is a single click. Attackers also know that a person expecting the format will not read the address carefully.
Note that a message showing notify@ringcentral.com is not automatically genuine. Display names and sender addresses are trivial to forge, and RingCentral’s real notification addresses are widely known precisely because so many businesses receive them.
The check that actually settles it
Hover over the play button or link, without clicking, and read the address. A genuine RingCentral link resolves to ringcentral.com immediately before the first single slash.
Common fakes:
https://ringcentral.voicemail-access.com/...— the real domain is voicemail-access.comhttps://ring-central.com/...— a hyphen added- A shortened link that hides the destination entirely — no legitimate voicemail notification needs one
Two other signals worth as much as the address:
- You do not use RingCentral. Obvious, and it catches most of these, since the campaigns are sent in bulk.
- The click leads to a login page. Your phone system does not need you to re-enter your Microsoft or Google password to hear a message. That page is there to harvest credentials.
The habit that removes the decision
Do not open voicemail from the email. Open your phone app or your provider’s portal directly and look there. If a message exists, it is waiting for you; if it is not, the email was fake. Once that becomes routine, the whole category of attack stops working on your team.
If someone clicked
- Password entered? Change it immediately, on that account and anywhere it was reused, and turn on multi-factor authentication.
- File downloaded or opened? Disconnect the machine from the network and call your IT team before doing anything else.
- Only clicked? Report it anyway. Modern attacks can act on a single visit, and a quick check costs nothing.
Speed matters far more than blame here. The businesses that come through these incidents well are the ones where people say something within minutes rather than hoping it was nothing.
Reducing how often anyone has to judge
Most of these can be stopped before delivery: authentication checks on the sending domain, comparison against lookalike domains, and inspecting links when they are clicked rather than when they arrive. That is what Shring Secure Mail is for.
For the remainder, the deciding factor is recognition, which is what our security awareness training builds with realistic simulations. And if your phone system itself deserves a look, our ShringVoice platform is one we run and monitor ourselves.
Got a message you are unsure about? Send it to us or call 678-680-4900. We would rather check ten than miss one.