How to Spot Fake Microsoft 365 Account Suspension Emails Targeting Australian Small Businesses

Summary

This guide helps you troubleshoot and resolve: How to Spot Fake Microsoft 365 Account Suspension Emails Targeting Australian Small Businesses. Follow the steps below to fix the issue.

Common Causes

Phishing emails claiming your Microsoft 365 account has been suspended are increasingly targeting Australian small businesses. These messages often mimic official Microsoft branding and use urgent language to pressure you into clicking malicious links. Once clicked, attackers can steal your login credentials and gain access to your business email, files, and sensitive customer data. This guide will help you identify fake suspension emails and protect your organisation from credential theft.

Common Signs of a Fake Microsoft 365 Suspension Email

Sender Address

• The email comes from a public domain such as @gmail.com, @outlook.com, or @yahoo.com instead of @microsoft.com or @microsoftonline.com
• The sender address contains misspellings or extra characters, such as micr0soft-support.com or account-security-m365.net
• The display name says "Microsoft Team" but the actual email address is unrelated

Urgent or Threatening Language

• Claims your account will be permanently deleted within 24 or 48 hours
• States that immediate action is required to avoid losing access to emails and files
• Uses pressure tactics such as "Act now" or "Verify immediately"

Suspicious Links and Attachments

• Buttons or links that say "Verify Account," "Reactivate Now," or "Sign In to Restore Access"
• Hovering over a link reveals a URL that does not match Microsoft domains
• Unexpected attachments claiming to be invoices, receipts, or account statements

Poor Formatting and Spelling

• Generic greetings such as "Dear Customer" instead of your name
• Spelling and grammar errors, or inconsistent capitalisation
• Low-resolution Microsoft logos or mismatched colours

What to Do If You Receive a Suspicious Email

1. Do not click any links or download attachments in the email.
2. Do not reply to the sender or provide any personal or business information.
3. Hover over any links without clicking to inspect the destination URL.
4. Check the sender's full email address, not just the display name.
5. Log in to Microsoft 365 directly by typing https://www.office.com into your browser, rather than using links in the email.
6. If your account is genuinely suspended, you will see a notification when you sign in through the official Microsoft portal.
7. Mark the email as junk or phishing in your email client.
8. Delete the email from your inbox and empty the Deleted Items folder.

How to Report a Phishing Email

In Microsoft Outlook

1. Select the suspicious email in your inbox.
2. Go to the Home tab on the ribbon.
3. Click Report Message in the Protect group.
4. Choose Phishing from the dropdown menu.
5. Click Report to send the message to Microsoft and remove it from your inbox.

In Outlook on the Web

1. Select the email message.
2. Click the More actions button (...) in the message list or reading pane.
3. Select Report > Report phishing.
4. Confirm by clicking Report.

Protect Your Microsoft 365 Account

• Enable multi-factor authentication (MFA) on all Microsoft 365 user accounts.
• Use strong, unique passwords and store them in a reputable password manager.
• Regularly review sign-in activity in the Microsoft 365 admin centre.
• Train staff to recognise phishing attempts and report suspicious emails immediately.
• Keep operating systems, browsers, and email clients updated with the latest security patches.

If you have already clicked a suspicious link or entered your credentials on a fake page, change your Microsoft 365 password immediately and enable multi-factor authentication if it is not already active. For further assistance, Open a Ticket with 220 Internet Services.

Still Having Issues?