In short: expect fake messages in the hours and days after a well-known outage. They ask you to sign in again, restore a mailbox or release held messages. Never sign in from a link in a message. Open Outlook or the Microsoft 365 portal yourself, and report anything that asks for a password or a sign-in code.

When the scams arrive

During the outage

Text messages and phone calls that claim to come from IT or the provider.

When service returns

Fake emails mixed into the backlog: restore your mailbox, sign in again, release held messages.

The days after

Fake follow-ups about the outage, such as account reviews or support offers.

Attackers follow the news. The outage is their pretext. Hexafusion IT Solutions.

Why an outage helps attackers

  • People expect unusual messages. After an outage, a notice about the mailbox seems normal.
  • The inbox is full. Hours of delayed email arrive together, and staff clear it quickly.
  • Everyone knows the story. The outage was in the news, so a message that mentions it sounds informed.

What the fake messages say

  • "Your mailbox was disabled during the outage. Sign in to restore it."
  • "Messages are being held for you. Release them here."
  • "Your password expired when service was restored."
  • A text message or phone call from "IT support" or "Microsoft" that asks for a sign-in code or asks you to install a remote support tool.

Phishing is a fake email or message designed to trick staff into giving away passwords or money. These are all phishing, with the outage as the excuse.

How to check a message

  1. Look at the sender's full address, not only the display name.
  2. Check where the link goes before you click, by resting the pointer on it. A real Microsoft sign-in page is on a Microsoft address.
  3. Be suspicious of urgency. "Within 24 hours or your mailbox is deleted" is pressure, not policy.
  4. Never give a password or a sign-in code to a link, a caller or a text message. Your IT team does not need them.

What to do

  • Open Outlook or the Microsoft 365 portal yourself. If something really needs your attention, it will show there.
  • Report the message to your IT team and do not forward it to colleagues.
  • If you clicked or entered a password, say so at once. Our guide I clicked a phishing link covers the first 30 minutes.
  • Keep multi-factor authentication (MFA) turned on. It adds a second step at sign-in, so a stolen password alone does not open the account.

One message for owners to send

After an outage, send staff one short note through your normal channel: service is back, IT will never ask for a password or a sign-in code, and any message about restoring a mailbox should be reported, not clicked. That single note removes most of the attackers' advantage.

See also: our incident report on the Microsoft 365 outage of November 12, 2026, the Microsoft 365 continuity checklist, and our guide to holiday season scams.

Common questions

Can I receive scam emails while email is down?
Not in the affected mailbox. During the outage attackers use text messages and phone calls. The fake emails arrive when service returns, mixed in with the delayed real messages.
What do scam emails after an outage look like?
They ask you to restore a disabled mailbox, sign in again, release held messages or renew an expired password, and they link to a fake sign-in page.
How do I know a sign-in request is real?
Do not use the link. Open Outlook or the Microsoft 365 portal yourself. If something needs your attention, it will show there.
What should I do if I entered my password on a fake page?
Tell your IT team at once, so the password can be changed and the account checked. Multi-factor authentication (MFA) limits the damage.

Want staff who can spot these?

We provide security awareness training and email protection for businesses in Metro Vancouver.

Talk to us