How to Spot Fake Microsoft 365 SharePoint File Sharing Phishing Emails Targeting Australian Small Businesses

Summary

This guide helps you troubleshoot and resolve: How to Spot Fake Microsoft 365 SharePoint File Sharing Phishing Emails Targeting Australian Small Businesses. Follow the steps below to fix the issue.

Common Causes

Phishing emails that mimic Microsoft SharePoint file sharing invitations are a common threat to Australian small businesses. These messages attempt to trick you into entering your Microsoft 365 credentials on a fake login page. This guide explains how to identify suspicious SharePoint invitations and what to do if you receive one.

Quick Fix Steps

1. Do not click any links or open attachments in unexpected file sharing emails.
2. Verify the sender's email address matches the person or organisation claiming to share the file.
3. Hover over links to check the actual destination URL before clicking.
4. Log in to Microsoft 365 directly at office.com rather than through email links.
5. Report suspicious emails to your IT support team or open a ticket with 220 Internet Services.

Detailed Instructions

1. Check the sender's email address

Phishing emails often use addresses that look similar to legitimate ones but contain subtle differences. Look for:

• Misspelled domain names (for example, micros0ft.com instead of microsoft.com)
• Public email domains such as @gmail.com or @outlook.com claiming to be from a colleague
• Extra characters or numbers in the sender address

2. Inspect the message content

Fake SharePoint invitations often contain red flags in the body of the email:

• Generic greetings such as "Dear User" instead of your name
• Urgent language demanding immediate action
• Poor spelling or grammar
• Requests to enter your Microsoft 365 password to view a document

3. Hover before you click

Move your mouse pointer over any link in the email without clicking. A small pop-up or status bar will show the actual URL. Be cautious if:

• The link does not point to a sharepoint.com or microsoft.com domain
• The URL contains an IP address instead of a domain name
• The link uses a URL shortener such as bit.ly or tinyurl.com

4. Access SharePoint directly

If you are expecting a shared file, do not use links from the email. Instead:

1. Open your web browser and go to office.com.
2. Sign in with your Microsoft 365 email address and password.
3. Select SharePoint from the app launcher.
4. Check Shared with me in the left navigation pane for legitimate files shared with you.

5. Look at the sharing invitation details

Legitimate SharePoint sharing emails from Microsoft typically include:

• The name of the person sharing the file
• The name of the file or folder being shared
• The SharePoint site or OneDrive location
• A consistent Microsoft branding layout

If these details are missing or vague, treat the email as suspicious.

What to Do If You Clicked a Suspicious Link

1. Do not enter any username or password on the page that opens.
2. Close the browser window immediately.
3. If you entered credentials, change your Microsoft 365 password at account.microsoft.com.
4. Enable multi-factor authentication on your Microsoft 365 account if it is not already active.
5. Open a ticket with 220 Internet Services so we can check for signs of compromise.

Tip: When in doubt, contact the sender through a separate method—such as a phone call or a new email message—to confirm they actually shared a file with you.

Caution: Never reply to a suspected phishing email. Replying confirms your email address is active and may lead to more targeted attacks.

If you receive a suspicious SharePoint invitation and need assistance verifying it, Open a Ticket with our Brisbane support team.

Still Having Issues?