1
Brand trust
Microsoft is everywhere, so a message with its logo feels familiar and official.
How it showed up hereThe same colors, fonts and sign-in box.
Microsoft 365 Impersonation
This short course is required for everyone at Charitybuzz. It takes about ten minutes: a few focused lessons, a quick quiz, and a confirmation that goes on your training record. Everything in it comes from the kinds of messages and requests our team is actually receiving, so what you learn here is what you will use at work.
What this covers How attackers pretend to be Microsoft — and the partners and nonprofits who use Microsoft 365 — to steal logins, and how to check safely.
What this is about
Charitybuzz runs on Google Workspace, but our partners, vendors and many nonprofits use Microsoft 365 and send us links to SharePoint, OneDrive and Teams all the time. Attackers know that, and they also send fake "Microsoft" alerts to everyone.
The goal is nearly always the same: a page that looks like the Microsoft sign-in box and asks for your email, password and sometimes the code from your phone. Anything you type there is theirs, and even a Microsoft account you never use for work can give them a way to reach other people.
47,794
tech and customer-support scam complaints filed with the FBI in 2025
$2.13B
reported lost to tech and customer-support scams in 2025
~1.5×
increase in those losses from 2024 ($1.46B)
Spot the signs
Quick check: for each item, decide whether it is a red flag or looks fine. Real Microsoft sign-in happens on login.microsoftonline.com or login.live.com.
0 of 6 answered
https://login.microsoftonline.com/The owner of the address is microsoftonline.com, Microsoft's own sign-in service.
https://microsoftonline.com.secure-login.co/office365The real owner is secure-login.co. The Microsoft name is only a decoration at the front.
https://office365-signin.support-desk.netAny address that adds extra words like "support-desk" after the Microsoft name is not Microsoft.
Pop-up on a website: "Your PC is infected. Call Microsoft Support now at this number"Microsoft does not display warnings with a phone number to call. These are scams.
A partner you work with sends you a SharePoint link you expectedYou know the person and expected it. Still, if in doubt, check with them.
An email saying your Microsoft 365 mailbox is full and your account will close unless you verify nowThreatening to close an account is a pressure tactic. Real storage issues are shown inside your account.
Why this works on smart people
2
Real exchanges with partners
We receive genuine Microsoft links from partners, which makes fake ones harder to spot.
How it showed up hereA "shared a OneDrive file with you" notice.
3
Fear of losing the account
Security alerts and "mailbox full" warnings make you act fast.
How it showed up here"Unusual sign-in activity detected".
4
Phone-based scams
Some attacks skip email and call or pop up, claiming to be Microsoft support.
How it showed up here"We detected a virus on your computer".
How this lands at Charitybuzz
Microsoft-themed attempts that fit a company like Charitybuzz look like these:
Everyone
The "unusual sign-in" alert
A message says there was a sign-in to your Microsoft account from another country and asks you to verify through a link.
The tell
You may not even have a Microsoft work account. The link goes to a page that is not on a Microsoft sign-in address.The right move
Do not click. If you do use Microsoft, sign in yourself at microsoft.com and check the security page. Report the message.Partnerships & Finance
The partner SharePoint share
A person claiming to be a contact at a nonprofit partner sends a SharePoint or OneDrive link for "the contract" or "the payout details" and asks you to sign in to see it.
The tell
The sender address does not match the partner's usual domain, or the page asks for your Google password.The right move
Contact your partner using a phone number you already had to confirm, before opening anything.Everyone
The fake support call or pop-up
A pop-up or phone call says it is Microsoft Support and that your computer has a virus, and offers to fix it through remote access.
The tell
Microsoft does not call you or put up warnings with a phone number.The right move
Hang up or close the page, and tell John. Never allow remote access to someone who contacted you.Red flags to watch for
A Microsoft sign-in page on an odd address
Only login.microsoftonline.com and login.live.com are real sign-in pages.
A message about an account you do not have
Plenty of "Microsoft" alerts go to people who have no Microsoft account at all.
A phone number to call
Microsoft does not put support numbers in warnings or pop-ups.
A threat to close your account
Pressure to act in hours.
An unexpected "shared with you" link
Even from a name you know, if you were not expecting it, confirm.
Asking for your password to "verify"
No legitimate service asks for it by message.
A request for remote access
Never let anyone who contacted you take control of your computer.
A sender that is not a Microsoft address
The display name can say anything.
A real Microsoft communication
- Can be confirmed by signing in at microsoft.com yourself
- Never asks for your password or a code
- Does not give a number to call for a "virus"
- Comes from a Microsoft address
- Gives you time to check
A fake Microsoft message
- Uses its own link to sign in
- Threatens to close the account
- Tells you to call a number or install software
- Asks for credentials or codes
- Appears when you were not expecting anything
What to do instead
Do not use the link or number
Everything inside the message could be controlled by the attacker.
Go to the service yourself
Type microsoft.com or the partner's own site, and check there.
Confirm partner links with the partner
Use a phone number you already had or a chat you already use.
Never give remote access
If someone you did not contact asks to connect to your computer, end the contact.
Report it
Use Gmail's Report phishing and tell John.
If you clicked — or entered something
Typed a password on a fake Microsoft page? Change it everywhere you use it
Change it on the real Microsoft site first, then on any other account that shares the password.
Allowed remote access or installed something? Stop and call John immediately
Disconnect from Wi-Fi if you can, and do not use the device until IT has checked it.
Report it — even if you think you got away with it
In Gmail, open the message, click the ⋮ menu and choose Report phishing. Then email [email protected] with a one-line summary of what you did (clicked, opened a file, typed a password, approved a prompt). Fast reports let IT block the sender for everyone.
Typed your password? Change it now
From a device you trust, go to myaccount.google.com by typing it yourself, change your password, and review Security → Your devices. If you reuse that password anywhere else, change it there too.
Approved a sign-in prompt or read out a code? Call IT immediately
This is the most urgent case: the attacker may already be in your account. Contact Charitybuzz IT ([email protected]) right away so they can end every session and reset access.
Opened an attachment or installed something? Stop and tell IT
Don't keep working on that device and don't try to "clean it up" yourself. Leave it on, disconnect it from Wi‑Fi if you can, and contact IT.
Key takeaways
- Real Microsoft sign-in pages are on login.microsoftonline.com or login.live.com.
- Microsoft will never call you or show a warning with a number to ring.
- Partner links are real often, so confirm them with the partner by another route.
- Never give anyone who contacted you remote access to your computer.
- Do not use links or numbers in the message. Go to the service yourself.
Knowledge check
Confirm your training record
This creates the completion record Charitybuzz keeps for compliance. Please use your work details.
Training complete
Your completion has been recorded. Thank you for helping keep Charitybuzz, our nonprofit partners, and our bidders safe.
Certificate ID: —
View & print certificateKeep this handy
- Real Microsoft sign-in pages are on login.microsoftonline.com or login.live.com.
- Microsoft will never call you or show a warning with a number to ring.
- Partner links are real often, so confirm them with the partner by another route.
- Never give anyone who contacted you remote access to your computer.
- Do not use links or numbers in the message. Go to the service yourself.