Scam library · Email & phishing · Small business
Microsoft 365 password expiry phishing
'Your password will expire in 24 hours. Click here to keep your current password.' The email looks like it came from Microsoft or your IT department.
The link leads to a fake Microsoft sign-in page. Scammers use your work login to read email, send invoices and attack your organization.
What the message looks like
From: IT Support <it-helpdesk@m365-notice[.]com>
Subject: Password expiry notice: action required
Your Microsoft 365 password expires today. Click below to keep your current password.
[ Keep Same Password ]
How this scam works
Phishing pages can look exactly like Microsoft's real sign-in screen. Some even show your company's logo and background, pulled automatically.
Advanced phishing kits can capture your password and your multi-factor code at the same time, logging scammers in immediately.
Once inside, attackers may set up email rules to hide their activity and use your account to send more phishing or fake invoices.
Many organizations no longer force regular password changes. Microsoft and NIST guidance recommend against routine password expiration without reason. So a 'password expiring' notice may be a sign of phishing.
If your password really needs changing, you can do it by going to your account settings directly or through your IT team's usual process.
Small businesses without IT departments are especially at risk. A simple rule, never sign in from an email link, helps.
Some versions say your account has been flagged for 'unusual activity' or that you need to 'verify' your account. Others pretend to be a shared document or Teams message that requires sign-in.
If you suspect you've been phished, telling IT quickly is the most important step. They can reset your password, sign out sessions and check for unknown rules.
Red flags
- Password expiry warnings with links.
- 'Keep same password' buttons.
- Senders that aren't your company's domain.
- Sign-in pages not on microsoft.com or microsoftonline.com.
- Urgent deadlines.
How to tell it’s fake
- Go to your account settings directly to check your password.
- Ask IT if the notice is real.
- Look at the URL before signing in.
- Use phishing-resistant multi-factor authentication if available.
- Real Microsoft sign-in pages use login.microsoftonline.com or login.live.com in the address bar.
What to do if you clicked, paid or shared info
Don’t panic, and don’t blame yourself. These scams are built by professionals. Act quickly, one step at a time.
If you clicked a link or called back
- Don't click. Report the email to IT.
If you paid
- If you were asked to pay, don't. Report it.
If you shared personal info, a password or a code
- If you entered your password, change it immediately, tell IT and check for unknown email rules.
Where to report and get help (U.S.)
If a message seems legit and you’re still not sure, get a second opinion before you act. Reporting helps stop scammers, even if money can’t be recovered. If you are in danger, call 911.
- Your bank or card issuer
Call the number on the back of your card or on your statement, not one from the message. Ask them to stop or reverse the payment and to watch the account. - Federal Trade Commission (FTC) · ReportFraud.ftc.gov
Report the scam and get a step-by-step recovery plan. - FBI Internet Crime Complaint Center (IC3) · ic3.gov
Report scams that happened online, especially if money was lost. Include phone numbers, websites and payment details. - AARP Fraud Watch Network Helpline · aarp.org helpline
Free, for anyone of any age: trained volunteers help you sort out next steps. 877-908-3360, Monday to Friday, 8 a.m. to 8 p.m. Eastern. - IdentityTheft.gov · IdentityTheft.gov
If you shared your Social Security number or someone opened accounts in your name.
How Gmork Scam Guard would warn you
Scam Guard in Chrome and Edge on your computer checks emails in Outlook on the web and Gmail. It recognizes fake Microsoft sign-in pages and warns before you type your password. If a notice seems legit, a scam expert or IT can confirm.
Scam Guard can miss things, so the checks above still matter. See what it warns about and what it keeps private.
Questions people ask
- Does Microsoft email about password expiry?
- Your organization may, but always change passwords through your account directly.
- Can phishing pages steal my MFA code?
- Some can. Report quickly if you entered one.
- What are email rules?
- Settings attackers use to hide or forward messages.
- How do I report phishing?
- Use your email's report button and tell IT.
- Will I get in trouble for clicking?
- Reporting quickly helps your organization respond. Most IT teams appreciate being told right away.