Fake Microsoft email: "your password expires today"

"Your Microsoft password expires today. Click here to keep it." The message looks like a security alert. It's a fake: its goal is to steal your password, and with it your mailbox.

How the scam works

The email imitates Microsoft, Outlook or Office 365. It copies the logos, the colours and a serious tone. It says your password will expire, your mailbox will be blocked or your messages deleted unless you act.

The button leads to a fake sign-in page. If you type your address and password, they go straight to the scammers. With access to your mailbox, they read your messages, reset your other accounts (bank, taxes, shopping) and write to your contacts pretending to be you.

Signs to look for

• Urgency: "expires today", "final warning", "account suspended within 24 hours".
• The sender's address isn't Microsoft's: an odd name, a free mailbox or a stranger's domain.
• A generic greeting without your name: "Dear user", "Dear customer".
• The link shows reassuring text but goes somewhere else. Hover over it, without clicking, to see the real address.
• An attachment "to open to keep your password" (an HTML file or a PDF).
• A QR code instead of a button.
• Typos or a slightly off layout.

What to do

1. Don't click the link or button, and don't open any attachment.
2. Check for yourself: open your account by typing Microsoft's website address, or use your usual app. If your password really needs changing, you'll see it there.
3. At work or school, ask your IT team before doing anything.
4. Report the email as phishing in your mail app, then delete it.

If you already clicked or typed your password

Change your password right away from the official site. Do the same everywhere you used that password. Turn on two-step verification and sign out devices you don't recognise. Check your mailbox for automatic forwarding rules: scammers sometimes add one to keep reading your emails. Warn your contacts if they may have received a strange message from you. At work, tell your IT team.

For more traps like this one, read how to spot a phishing email and the definition of phishing.

Check it with Fishi

Not sure about an email that claims to be from Microsoft? Forward it to check@fishi.email, ideally as an attachment. Fishi checks the sender, looks at where the links really go and replies in plain language: safe, suspicious or scam, and what to do. It's free and needs no account.