Spot a Phishing Email “From Microsoft” and Report It

The email looks like it's from Microsoft, sounds like it's from Microsoft and still isn't from Microsoft.

"I'm a bit skeptical about this email. What could it be, or can we block something like this?" With that question, the head of sales at an industrial company forwarded an email to his IT service provider. Subject: "Microsoft Identity Authentication Expiry Notice". Sender: "Microsoft helpdesk", followed by a few random characters, sent from a Gmail address. Content: practically empty, with a PDF attachment.

The skepticism was exactly right. The first attempt to send the email to IT, however, was only a screenshot, and there is little you can check with that. Here is how to recognize emails like this, how to report them properly and what IT can then do.

How can I tell a fake Microsoft email?

Usually by three things: sender, pressure and request. In the real-world case, there were several warning signs at once:

• Sender address doesn't match – gmail.com instead of microsoft.com
• Odd sender name – "Microsoft helpdesk ®" with random characters
• Pressure and deadline – "Authentication Expiry", supposedly something is about to expire
• Empty email with attachment – no text, just a PDF
• Request to open something or sign in – a link in the PDF to "confirm"

Other typical signs: a greeting without a name ("Dear User"), spelling mistakes, links whose target (when you hover over them with the mouse) doesn't belong to Microsoft, and attachments as ZIP, HTML or PDF with a link.

Rule of thumb: Microsoft doesn't ask you by email to "confirm" your password through an attachment or link. You see notices about your account when you sign in yourself through the known address (portal.office.com).

Why is a PDF attachment dangerous?

The PDF itself is often harmless, but the link inside it is not. Attackers use PDFs because mail filters check links in attachments less well than links in the email body. The link leads to a convincing fake Microsoft sign-in page that captures credentials and often the MFA code too.

Step 1: Don't click, don't reply

• Don't open any links, don't open any attachments.
• Don't reply. That only confirms that the address is active.
• Don't delete it before IT has it. Otherwise nobody can check whether other colleagues received the same email.

Step 2: Forward the email to IT correctly

As an attachment, not as a screenshot and not as a normal forward. Only the original email contains the headers. From them, IT can see which servers the email came through, whether SPF, DKIM and DMARC check out and whether other mailboxes are affected.

Classic Outlook:

• Select the email › Ctrl+Alt+F, or
• Home › More (reply actions) › Forward as Attachment.
• Alternatively: open a new email to IT and drag and drop the suspicious email into the window.

New Outlook / Outlook on the web:

• Select the email › three-dot menu › Forward › Forward as attachment.

Even better, if it is set up: the “Report” or “Report phishing” button in Outlook. It sends the email to Microsoft and, depending on the configuration, to your own IT, and removes it from the inbox.

Step 3: What IT checks

In the real-world case, the result of the check was sobering but typical: Technically, it is an entirely normal Gmail message with a PDF attachment. Nothing a filter reliably identifies as malicious. What makes it suspicious are the circumstances: sender, name, empty content.

14 days free

IT support that fixes itself.

SuperSupport fixes IT problems right on the device, before they turn into tickets. Try it free for 14 days.

Start free trial

IT can then:

• Check in mail flow (Exchange admin center or Defender) who received the same email, and remove it from all mailboxes.
• Block the sender, in the Tenant Allow/Block List.
• Report the link or attachment to Microsoft as phishing.
• Check sign-ins, in case someone clicked.

Can't you just block something like this?

Individual senders, yes; the pattern, unfortunately hardly. Attackers constantly change sender addresses, mostly through free email providers. Blocking Gmail entirely is not an option for most companies, because customers and suppliers write from there too. What helps:

• Turn on the “External sender” notice in Outlook so that emails from outside are visibly marked.
• Impersonation protection in the Microsoft Defender anti-phishing policies, so that sender names like "Microsoft" or your own management stand out.
• Safe Links and Safe Attachments (Defender for Office 365), which check links when they are clicked.
• Phishing-resistant sign-in with passkeys. Then stolen passwords are of little use. See Microsoft is turning off SMS MFA.
• Regular short training sessions. The employee's skepticism in the real-world case was the best protection.

What to do if someone already clicked

1. Tell IT immediately. Don't wait out of embarrassment.
2. If credentials were entered: change the password right away.
3. IT signs out all sessions and checks the sign-ins of the last few days.
4. Check mailbox rules: Attackers like to set up forwarding or rules that hide replies.
5. Warn contacts if emails were sent from the mailbox.

Related topics: Admin consent request in Microsoft 365 (attacks through fake apps) and Microsoft 365 quarantine.

How does SuperSupport help with suspicious emails?

"Is this email real?" is a question employees should ask too often rather than too rarely. The SuperSupport agent takes it in the chat, explains the warning signs, shows how to forward the email to IT as an attachment, and reports the case, including the question of whether anyone has already clicked. The check in the mail system stays with IT. What this looks like for internal IT teams and MSPs is explained on the respective pages.

Frequently asked questions

How can I tell a fake Microsoft email?

By the sender address (such as gmail.com instead of microsoft.com), by odd strings of characters in the sender name, by pressure (“expires today”), by empty emails with an attachment or link, and by requests to sign in through a link. Microsoft doesn't send emails in which you have to confirm your password through an attachment.

Why should I forward the email as an attachment and not as a screenshot?

Because only the original email contains the headers, which show where it really came from, which servers it passed through and whether SPF, DKIM and DMARC check out. A screenshot only shows what the attacker wants to show.

How do I forward an email as an attachment in Outlook?

Select the email, then press Ctrl+Alt+F, or choose Forward as Attachment from the More (reply actions) menu. In new Outlook: open the email › three-dot menu › Forward as attachment.

Can IT just block emails like this?

Individual senders, yes; the pattern, often not. Attackers constantly change senders and content. Technically, such an email is often unremarkable: a normal Gmail message with a PDF. That is why people remain the most important layer of protection.

What do I do if I already clicked?

Tell IT immediately. If credentials were entered: change the password right away, have all sessions signed out and check the sign-ins of the last few days. The faster, the better.

14 days free

IT support that fixes itself.

SuperSupport fixes IT problems right on the device, before they turn into tickets. Try it free for 14 days.

Start free trial