Warning: Microsoft data will (not) be deleted.
A phishing email posing as Microsoft 365 Support New Zealand is pushing you to act urgently to stop supposed data deletion and hand over account or payment details.
You could receive an email with the subject line "Last Notice: Action needed to avoid data deletion !" that appears to come from Microsoft 365 Support New Zealand. It warns that your Microsoft 365 data is scheduled for deletion because a subscription payment has not gone through, then pressures you to take action to keep your account active. If you use Microsoft 365, it is designed to look close enough to a real billing notice that you might act before thinking.
What gives it away is that the sender is not a Microsoft domain at all. It is coming from support-subscription-nz-members.jumapab.gob.mx, which does not match the brand it claims to represent. Even though some email checks passed, the sending setup still does not line up cleanly, with SPF only soft failing, which means the message was not fully authorised to send on behalf of that domain. In plain terms, the branding says Microsoft New Zealand, but the actual sender does not.
The attacker is trying to get you to click through, reply, or hand over Microsoft 365 credentials and possibly billing details. If you engage, you could give an attacker access to your email, files, contacts, and business conversations. That can quickly turn into account takeover, follow-on phishing from your mailbox, or fraudulent payment requests sent in your name.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Inspect the real sender address before you click anything, especially on Microsoft 365 billing or storage warnings.
- Do not: Click links, open prompts, or reply to subscription emails that use urgency about data deletion or missed payment.
- Verify: Go directly to your Microsoft 365 admin portal or contact your authorised IT provider to confirm any billing issue.
- Report: Send suspicious messages to your internal IT team or security provider so the sender domain and message can be blocked.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
See what a genuine Microsoft message looks like, the real sender domain, the real link destination, and where to report a fake.