Microsoft 365 phishing example: the password that expires today
It copies an automatic notice from your work account: the password expires in a few hours and a button promises to keep it. The button opens a copy of the sign-in screen that captures the username, the password and sometimes the verification code.
Hello lucy.fernandez@yourcompany.example (Red flag 2),
The password for your account expires today at 11:59 PM. If you do not confirm it, you will lose access to email, Teams and OneDrive (Red flag 3).
You can keep your current password with one click:
Account Security Team. To stop receiving these notices, update your preferences.
Five red flags that give the fake alert away
A sender that is neither your company nor Microsoft
Password expiry notices are set up by your IT team and come from known domains. “m365-account-support” is a domain built to sound official.
The greeting is your email address
A system that manages your account knows your name. A bulk send only has the address, so it uses it as the greeting.
Losing everything today
Email, Teams and OneDrive in one threat, with a deadline. The urgency is what keeps you from checking the link.
“Keep the same password”
No security policy lets you skip a change with one click. If your password really expires, you change it from the usual portal.
The real domain is at the end
The link starts with “login.microsoftonline.com”, but the domain that counts is the one right before the first slash: “verify-account.example”. Everything before it is a subdomain anyone can create.
What to do if you get one
- Do not click the button. If you want to check your account, type the address of the portal you always use.
- Report it with your email client’s report button or forward it to security as an attachment.
- If your company sends real expiry notices, compare them with this one: sender, tone and link destination.
- Warn your team: these sends often hit many people in the company at once.
If you already typed your password
- Change it from the usual portal and ask IT to sign out every open session.
- If you typed a verification code or approved a notification, say so: with that, someone may have signed in even though the account has MFA.
- Ask IT to check your mailbox for forwarding or deletion rules you did not create.
The same trap on other channels
On Teams
An outside user named “IT Support” sends a chat with a link “to revalidate your account”. Teams labels senders from outside the organization as external: that label is the red flag.
By text message
A short message says your work account will be locked and includes a shortened link. On a phone it is harder to see where a link goes than on a computer.
With a QR code
The email has no link, only a QR code “to reactivate authentication”. The email filter does not read it as a link, and the phone camera opens the destination.
Questions about Microsoft 365 phishing
Other scams to recognize
How many people in your company would click “Keep current password”?
Whalemate runs email phishing simulations natively, including account alerts like this one. Whoever types a password gets on-the-spot training on the red flag they missed, and whoever reports the email is measured too, because reporting is the habit you want.