How to recognise and safely handle a suspicious 'Your password expires today' or fake IT password reset email

Summary

This guide helps you troubleshoot and resolve: How to recognise and safely handle a suspicious 'Your password expires today' or fake IT password reset email. Follow the steps below to fix the issue.

Common Causes

Phishing emails that impersonate IT support or Microsoft 365 are one of the most common ways attackers try to steal business credentials. These messages often claim your password expires today, your account has been compromised, or you must verify your login immediately. The goal is to rush you into clicking a link and entering your details on a fake webpage. This article explains how to recognise these emails, what to do if you receive one, and how to safely report it to 220 Internet Services.

What these phishing emails typically look like

While attackers constantly change their wording, most password reset phishing emails share a handful of tell-tale signs. Use the checklist below to quickly assess any suspicious message.

Common warning signs

• Urgency or fear: Phrases such as "Your password expires today", "Action required within 24 hours", or "Your account will be locked".
• Generic greeting: "Dear User", "Dear Customer", or no greeting at all, instead of your actual name.
• Mismatched sender address: The display name says "IT Support" or "Microsoft 365", but the actual email address is from a random domain such as [email protected] or a personal Gmail account.
• Suspicious links: Hovering over the link reveals a URL that does not match the legitimate domain. Genuine Microsoft 365 password resets will only ever come from microsoft.com, office.com, or your organisation's verified domain.
• Unexpected attachments: HTML or PDF files that prompt you to "enable content" or "sign in".
• Poor spelling or formatting: Unusual grammar, mixed fonts, or odd spacing.
• Unusual request: Being asked to reply with your password, or to send it via SMS.

Quick Fix Steps

If you have received a suspicious password reset email but have not clicked any links or entered any details, follow these steps straight away.

1. Do not click any links or open any attachments in the email.
2. Report the message to 220 Internet Services by opening a ticket through the support portal. Include a screenshot of the email and the sender's full address.
3. Delete the email from your inbox and then empty your Deleted Items folder.
4. If you use Microsoft 365, report the message using the built-in Report Phishing button in Outlook so Microsoft's filters can block it for other users.

If you have already clicked the link or entered your password

Acting quickly can limit the damage. Complete the steps below in order, even if you are unsure whether your details were captured.

Step 1: Change your password immediately

1. Open a new browser window and navigate directly to the legitimate sign-in page. Do not use any link from the email.
2. For Microsoft 365, go to https://myaccount.microsoft.com and select Change password.
3. For your Windows computer login, follow the steps in our related guide: Password reset (Windows login).
4. Choose a strong, unique password that you have not used elsewhere.

Step 2: Check and revoke suspicious sessions

1. In Microsoft 365, go to https://myaccount.microsoft.com and select Sign out everywhere under Devices.
2. Review Sign-in activity for any locations or times you do not recognise.
3. If you see anything unusual, report it to 220 immediately through the support portal.

Step 3: Enable multi-factor authentication

1. In https://myaccount.microsoft.com, select Security info.
2. Add a second factor such as the Microsoft Authenticator app, a phone number, or a hardware security key.
3. Save your changes and confirm the new method works before closing the browser.

Step 4: Notify 220 Internet Services

1. Open a ticket at app.220.com.au as soon as possible.
2. Include the time you clicked the link, what information you entered, and any actions you have already taken.
3. Our security team will review your account, force a password reset if required, and check for any unauthorised mailbox rules or forwarding.

How to inspect an email safely

If you want to double-check a message without clicking anything, use these techniques.

On a Windows computer in Outlook

1. Open the email in your inbox. Do not click any links.
2. Hover your mouse cursor over the sender's name to reveal the full email address.
3. Hover over any link (without clicking) to display the actual destination URL at the bottom-left of the Outlook window.
4. Right-click the email in the message list and choose View → View Message Details to see the full message headers, including the originating server.

On a Mac in Outlook or Apple Mail

1. Open the email and press Command + Option + H in Outlook for Mac to view the message headers.
2. In Apple Mail, select the message and choose View → Message → Raw Source.
3. Look for the Return-Path and Received From fields to confirm the message originated from the claimed organisation.

On iPhone or iPad

1. Open the Mail app and tap the sender's name at the top of the message to reveal the full address.
2. Press and hold any link to preview the URL without opening it.

On Android

1. Open Gmail and tap the three dots next to the reply button.
2. Select Show original to view the full message headers.
3. Press and hold any link to preview the URL.

Reporting the email to Microsoft 365

Reporting phishing helps protect your colleagues and other Australian organisations. The exact steps depend on which Outlook app you use.

Outlook on the web (Outlook 365)

1. Select the suspicious message without opening it.
2. In the top toolbar, click Report → Phishing.
3. Follow the prompts to confirm. The message will be moved to your Junk folder and submitted to Microsoft.

New Outlook for Windows or Outlook for Mac

1. Select the message.
2. On the Home ribbon, click Report → Phishing.
3. Confirm the prompt to submit the report.

Classic Outlook for Windows

1. Select the message.
2. On the Home ribbon, click Report Message → Phishing.

Outlook mobile (iOS and Android)

1. Open the message.
2. Tap the three dots in the top-right corner.
3. Choose Report → Report Phishing.

Preventing future phishing emails

While no filter catches every phishing message, the following steps significantly reduce your risk.

• Keep multi-factor authentication enabled on all work accounts.
• Use the Microsoft Authenticator app rather than SMS where possible.
• Report suspicious messages promptly so filters can be updated.
• Keep your operating system, browser, and Outlook up to date.
• If you are unsure about a message, contact 220 Internet Services through the support portal before clicking anything.

Still Having Issues?