Fake Microsoft emails are making the rounds. Here’s how to spot one.

Our helpdesk is seeing a wave of convincing emails that look like they come from Microsoft, Office 365 or OneDrive. They’re designed to rush you into clicking a link and entering your password. Once a scammer has that password, they can read your email, take your files and send more scams from your account to the people who trust you.

The good news: these messages follow a pattern, and once you know it they get much easier to spot. Here’s a real one that landed this week and what gives it away.

What this fake Microsoft email looks like

Five signs it’s a fake

1. Panic language. “Blocked,” “105%,” “syncing is paused.” Scams rush you so you don’t stop to think.
2. Sent to the wrong person. It asks you to “manage the subscription for this organization.” Real admin alerts go to whoever runs your IT, not to everyone on staff.
3. Sloppy details. The time says “UTC” but shows a Pacific offset, and junk code (“MIME [Subject]”) and a broken image sit at the bottom.
4. Generic sign-off. “The Office 365 team” and “Support Team.” No names, no real contact information.
5. Every line is a link. Hover over a link (don’t click) and the address will not be a microsoft.com page.

Be suspicious of any email like these

This campaign isn’t limited to storage warnings. Treat any unexpected “Microsoft” notice in these four categories with caution.

What to do instead of clicking

1. Don’t click. No links, buttons, QR codes or attachments, and don’t reply.
2. Check the real way. Open a browser and go to office.com yourself, or open the Outlook or OneDrive app. If there’s a real problem with your account, it will show there.
3. Report it. In Outlook, use the Report button (Report → Phishing), or forward the message to your IT provider. Then delete it.
4. Tell your team. If one person got it, others likely did too. A quick heads-up keeps the next person from clicking.

Not every phishing email asks for a password, either. Some try to trick you into approving a sign-in code instead, like the device code phishing campaign we covered in September. The same rule applies to both: when an email pushes you to act fast, slow down and check through the app or site you already use.