Outages Make Scams Look Normal: Spotting Fake Microsoft Fixes and Refund Offers

When a service as widely used as Microsoft 365 stumbles, the people who run the scams get busy too. A widespread outage that took down Outlook, Teams and other daily tools has disrupted work and personal life for millions, and at the time of writing, business and consumer Microsoft 365 products were still experiencing service degradation. That gives fraudsters a ready-made story: everyone is already confused, already checking for updates and already expecting odd messages.

Here's the thing about outage scams. They don't need to be clever. They only need to sound like something a stressed person would expect this week. A request to re-sign in, a refund offer or a helpful stranger offering a fix can all feel plausible when the real service is down.

Why outages are a good time for scammers

Eric Hulse, Vice President of Research and Development at Command Zero, an AI Security Operations Center, has watched similar scams appear during earlier outages. When CrowdStrike went down in 2024, he says, the company's own team members were sent malware disguised as software that would "fix" the problem. If internal staff at a security firm can be targeted that way, ordinary users are an easier mark.

Hulse's read is that fraudsters follow what people are trying to do next. "They want to fix the problem, get back into their account, reach support or get compensated, and there's a fake version of each." Think of it as a map of the four things an anxious user wants, with a counterfeit waiting at every stop.

The common forms you're likely to see include:

• Lookalike websites designed to steal your password and other information
• Fake support websites
• Calls or emails requesting access to accounts
• Promises of refunds for those affected by the outage
• Phishing links for restoring affected accounts

Hulse admits it's hard to predict which version will spread next. His practical advice is to watch the email versions in particular, such as a message asking you to sign in to restore your mailbox or to re-enroll your multifactor authentication. Those messages look like routine IT housekeeping, which is exactly why they work.

Payment requests are the sharpest warning sign

If a message involves money, slow down. Hulse describes a common pattern: "Someone posing as your boss or a vendor, or the title company handling your closing, texts to say their email is down and they need a payment sent to a different account."

Here's why this one lands so well. Normally, a sudden request to change where a payment goes would make you pause. During an outage, that pause disappears. As Hulse puts it, "Normally that request would look strange. This week it doesn't, because everyone knows email really is down." The outage becomes the cover story.

Consider a simple worked example. Your colleague emails you from a new address saying their mailbox is down, and asks you to wire a deposit to a different account today. Two things should trigger a check: the change of channel and the change of destination. Confirm by calling the person at a number you already have on file, not the number in the message. The same logic applies to anyone you're paying for a home purchase, a contractor or a regular bill.

Red flags to check before you click or reply

The biggest scam red flag, in Hulse's view, is that the message reached you first. "Microsoft doesn't call people or text them about fixing a problem, so I'd treat any unsolicited message about the outage as a scam until proven otherwise." That's a useful default. If you didn't ask for it, treat it with suspicion.

If a message claims to come from Microsoft, be especially skeptical. If it comes from someone you already know, verify it through a channel you already use, such as their known email address or phone number, not the one that just contacted you.

Urgency is the other tell. Hulse points out that consumers have nothing to fix here: "There's nothing a consumer needs to do about this outage at all. Microsoft has to fix it, and there's no tool to download or account to re-verify on your end." So any message telling you to download something, re-verify an account, or hand over login details is working against that reality. You don't need to provide credentials, make payments or take steps to restore your account in response to a message.

Preparedness that limits the damage next time

This outage makes a broader point: relying on one tech provider with no backup can be risky. Hulse recommends setting up alternatives before the next disruption, and the steps below are useful well beyond Microsoft.

• Set up a backup email from another provider. Hulse suggests adding this second address as a backup contact at your bank and brokerage. Email is how many people reset passwords for other accounts, so a backup gives you another route back in if your main inbox goes dark.
• Use a password manager. It helps you keep unique passwords without memorizing them, and it can flag fake sites. "It won't fill in your password on a look-alike site," Hulse explains. If a page doesn't offer to autofill your saved password the way the real one does, that's a sign you may not be on the right page. Popular options include 1Password, Bitwarden and Dashlane.
• Write down important phone numbers. Whether the problem is a system outage or a dead phone battery, a paper list of key contacts means you can still reach people if your phone's contact list is out of reach.
• Don't rely solely on email for important information. "Keep copies of insurance cards and travel confirmations on your phone or computer instead of leaving them in your inbox," Hulse says. Backup copies of key documents keep an outage from turning into a bigger hassle.

If you think you've already been taken in, act quickly. Report it to the FTC and take immediate steps to protect your accounts, starting with changing passwords and contacting your bank if you shared payment details. The sooner you move, the better your chances of limiting the damage.

Paid identity-monitoring services exist, and some people find them useful for ongoing alerts. They're a personal decision, though, and they won't stop a scam message from reaching your inbox. The strongest protection during an outage is still a simple habit: pause before you act on anything that's urgent, unexpected or involves money. Treat every "fix" as suspect until you've verified it through a channel you trust.