Detects outbound scam content deployed via inbound email from Spotify's legitimate no-reply address (no-reply@spotify.com). The rule extracts the greeting line immediately before the standard header 'Welcome back to Spotify' from the email body and feeds that greeting to an ML/NLU classifier to determine if the greeting expresses a 'callback_scam' intent. If both conditions are met (sender matches and the greeting intent is callback_scam), the rule flags the email as a potential callback phishing attempt. The approach combines regex-based content extraction with language understanding and sender verification to identify social-engineering abuse of the genuine notification template.