Microsoft outage: concerns scammers may take advantage

Concerns have been raised that scammers may try to capitalise on the global outage to Microsoft services being experienced by businesses, schools, GPs, emergency services and others.

Users of Microsoft 365 - the cloud software which includes services such as Outlook, Teams, Word, Excel, and PowerPoint - started noticing issues at around 6pm GMT on 12 November.

Microsoft have insisted that it is not a cyberattack, and appears to be an issue involving a configuration update.

In the UK, the NHS, which has a five year deal to use Microsoft 365, says a range of services have been disrupted, while police forces have asked people to report crimes via phone instead of doing so online.

However, the outage has raised concerns that scammers may try to take advatange of the chaos by sending fake texts or emails that appear to be from Microsoft or IT support offering to reset systems.

An article in Human Resources Director points out that outages can be used as cover for phishing emails offering support or password resets, and advises checking any such message through a separate channel.

The Customer Owned Banking Association in Australia has released a similar warning saying that during outages, fraudsters may pivot to making scam phone calls to try and obtain sensitive information.

“Scammers are highly opportunistic and will deliberately create a false sense of urgency, trying to panic and rush you into making a mistake before you have time to think,” says the COBA's Martin Latimer.

“Even if you are expecting a phone call from your internet provider or your company’s IT provider, beware and make sure they are exactly who they say they are. If suspicious, hang up and ring them back on a number you know is genuine.

“Be sceptical of any unsolicited calls, emails, or messages requesting that you download a software patch or provide remote access to fix your computer.”

Latimer also advises that after the outage is resolved, scammers may still try to pose as technical support.

“Avoid sharing any information that is not relevant, and don’t give out information to unknown or unverified individuals or organisations, especially if the contact was unsolicited,” he adds.