No Ticket Needed

Appearance

4 min fix 5 min read Recently reviewedBeginner

By , IT support technician

Quick Answer

Hover over the suspicious message, click the three-dot menu (⋯), and select Report this message. Choose Phishing as the reason. Never click links from unknown external contacts, especially those with urgency tactics.

How to Recognize and Report Suspicious Microsoft Teams Messages ​

Estimated Time to Fix: 4 minutes

Applies to: Microsoft Teams (desktop, web, mobile)
Article Type: Informational
Last Updated: 2026-07-16

Summary ​

Phishing attacks in Microsoft Teams are increasing rapidly. Attackers use fake messages, impersonation, and malicious links to steal credentials or install malware — like email phishing, but inside Teams. This guide shows you how to spot the warning signs and report suspicious messages.

Prerequisites ​

  • A Microsoft Teams account.
  • No special permissions needed — any user can report messages.

Instructions ​

1. Recognize the Warning Signs ​

Learn what suspicious Teams messages look like so you can catch them before clicking.

Check the sender's identity carefully. Warning signs include:

  • The sender's name is similar but slightly different from a real coworker (e.g., "Jon Smith" instead of "John Smith").
  • The profile picture is generic, missing, or looks AI-generated.
  • The message comes from an External user you don't recognize (look for the "External" tag next to their name).
  • The sender claims to be from "IT support" or "HR" but you don't recognize the account.

Look for urgency and pressure tactics. Phishing messages often say things like:

  • "Your account will be deactivated in 24 hours."
  • "Urgent: CEO needs gift cards purchased immediately."
  • "Click here immediately to verify your identity."
  • "I need this done before end of day — don't tell anyone."

Inspect any links before clicking.

  • Hover over the link (or long-press on mobile) to see the actual URL.
  • If the URL doesn't match your company's domain or goes to an unfamiliar site, don't click it.
  • Watch for lookalike domains: micros0ft.com (zero instead of 'o'), microsft-login.com, or sharepoint-verify.xyz.

Watch for unexpected file sharing.

  • Be cautious if someone you don't know shares a file.
  • Suspicious file names include: invoice_final_URGENT.exe, payroll_update.zip, or document.html.
  • Legitimate file sharing at work happens through SharePoint or OneDrive — not through random download links.

DANGER

If you've already clicked a suspicious link or entered your password on a suspicious page:

  1. Change your Microsoft 365 password immediately.
  2. Notify your IT department or security team right away.
  3. See Understanding What to Do When You Suspect Your Account Has Been Hacked.

2. Report a Suspicious Message in Teams ​

Use the built-in reporting feature to flag the message for your security team.

  1. Hover over the suspicious message (or long-press on mobile).
  2. Click the three-dot menu (⋯) that appears.
  3. Select Report this message (or More options > Report this message).
  4. Choose the reason:
    • Phishing — Messages trying to steal credentials or trick you into clicking malicious links.
    • Spam — Unwanted commercial or promotional messages.
    • Inappropriate content — Harassment or offensive content.
  5. Click Report.

Microsoft and your organization's security team are notified automatically.

3. Block the Sender ​

Prevent the sender from contacting you again.

  1. Click the sender's name to open their profile card.
  2. Click the three-dot menu (⋯) on the profile card.
  3. Select Block.

The sender can no longer send you messages, calls, or meeting invitations through Teams.

TIP

Blocking is especially useful for external contacts. If the sender is an internal coworker whose account has been compromised, report the message and notify IT instead of blocking — IT needs to secure that person's account.

4. What to Do If You're Not Sure ​

If a message looks suspicious but you're not certain:

  1. Don't click any links or open any attachments.
  2. Contact the person through a separate channel — call them, email them, or walk to their desk — to verify they actually sent the message.
  3. If you can't verify, report it anyway. It's always safer to report a legitimate message than to click on a phishing one. Your security team would rather investigate a false alarm than deal with a compromised account.

5. Verify You're Protected ​

Confirm the message is handled.

  1. Check that the message now shows a Reported label or has been removed from the chat.
  2. If you clicked a suspicious link, change your password immediately and notify IT.
  3. Check your sign-in activity for any unfamiliar logins.

Troubleshooting ​

WARNING

Teams phishing is harder to spot than email phishing because Teams feels like an internal, trusted space. Attackers exploit this trust. Treat unexpected Teams messages from unknown senders with the same caution you'd give a suspicious email.

Symptom / ErrorPotential CauseSolution
"Report this message" option doesn't appearFeature not enabled by your organizationTake a screenshot of the message and forward it to your IT helpdesk or security team manually.
External user messages keep appearingExternal access enabled for your organizationThis is normal — many companies allow external Teams communication. Report and block any unwanted contacts.
You accidentally clicked a phishing linkCredentials may be compromisedChange your password immediately, review your sign-in activity, and tell IT you clicked a link in a suspicious Teams message — say plainly whether you entered your password, because that decides whether they sign out your sessions.
Suspicious meeting invite from unknown personPhishing via calendarDecline the meeting, report the message, and block the sender. Do not click any links in the meeting body.
Colleague's account sending strange messagesTheir account is compromisedDo not respond. Notify IT directly (by phone or in person) so they can lock the account.