The rule flags inbound messages sent from Arketa’s notification address (no-reply@notifications.arketa.co) that are abused to deliver callback scam content. It uses two detection paths. First, a Natural Language Understanding (NLU) check on the thread text (body.current_thread.text) identifies intents named “callback_scam” with a non-low confidence level, indicating a likely callback scam. Second, it performs content analysis on the message body/subject when brand references are present, looking for well-known brands (McAfee, Norton, PayPal, eBay, Symantec, Best Buy, Lifelock, etc.) in combination with multiple scam-related keywords. A phone number must also be present in an obfuscated format, detected via multiple regex variants to catch common evasion techniques (confusables, spacing, punctuation). Specifically, if the body/subject contains a brand reference and at least three of a set of keywords (purchase, payment, transaction, subscription, antivirus, order, support, receipt, invoice, call, cancel, renew, refund, host key) and a phone number is detectable, the rule triggers. The rule therefore flags as Callback Phishing when either the NLU path or the brand+keywords+phone path is satisfied. Attack techniques include social engineering, impersonation of a brand, evasion, and potential out-of-band pivot. Detection methods include Natural Language Understanding, content analysis, and sender analysis. This rule is tailored to inbound messages and relies on the sender identity, content signals, and obfuscated contact information to identify scam attempts masquerading as Arketa notifications.