This rule detects inbound messages that originate from the freshbooks.com root domain and analyzes their textual body with a natural language understanding (NLU) model to identify callback scam intent. If the NLU classifier returns an intent named callback_scam with a confidence level that is not low (i.e., medium or high), the rule flags the event as potential service abuse. The goal is to identify instances where legitimate FreshBooks infrastructure is being misused to deliver callback scam lures to users, enabling early notification and response to phishing attempts that leverage a trusted brand. The rule combines sender-domain validation (freshbooks.com) with content-based intent classification to provide a targeted signal for callback phishing, a social-engineering threat where attackers induce victims to take actions or disclose information via a callback mechanism. It leverages two detection techniques: Natural Language Understanding (to classify message content) and Sender analysis (to verify domain legitimacy). The rule is categorized under medium severity and is aligned with attack type: Callback Phishing and tactics: Social engineering. It is suitable for environments that inspect inbound messages or emails for brand-abuse and phishing signals, and it complements traditional email authentication checks by adding semantic analysis of message content. Potential enhancements could include additional checks (DKIM/DMARC alignment, rate limits, and contextual signals) to reduce false positives and improve resilience against domain spoofing and subdomain abuse.