Even if someone were to fall for this scam, and the scammer had their Microsoft 365 email and password, when the scammer tries using their credentials a text, call, or email would go to the real user for verification and that would stop the scammer in their tracks. You might even use the Microsoft Authenticator app.

When your Microsoft 365 administrator activates multifactor authentication then each time you log into Microsoft 365 you are asked for a verification code via text or call. Multifactor authentication would completely prevent this type of attack. You may still want to alert the sender so they can check to see if their email has been hacked. If either do not match then do not click on anything. If it is expected or typical for the sender still do steps 2 and 3 above. If this is not an expected email then do not click on anything and contact the sender to see if they actually sent you this message.

Now you’re equipped with all the information you need. A bubble will appear with the link destination. Check the “sender,” not just the name, but also the email address.How can you avoid this scam? How to Vet Your Email MessagesĮvery email that appears in your Inbox should be vetted no matter if it’s from a friend or foe (see image below). If you have administrative privileges they can wreak even more havoc. They can get into your email, send spam in your name, see/edit/delete your OneDrive files. They now have your Microsoft 365 email and password. At this point you may become suspicious but it’s too late.

You may end up at or OneDrive but you don’t have access or you don’t see the shared document. You enter your email, which is accepted, and then you enter your password, which fails on the first attempt but succeeds on the second. Upon clicking on the link or the folder you are forwarded to a familiar Microsoft 365 sign in box. ” In the body of the email you see what looks like a familiar OneDrive notice about an available document that has been shared with you by someone you know. A seemingly innocuous email shows up in your Inbox with a subject something like this, “Document for. The OneDrive phishing scam is particularly dangerous because of how insidious it is.

Microsoft onedrive email address