Dodgy Microsoft billing email doing the rounds
A phishing email posing as an official Microsoft 365 Australia and New Zealand billing notice is circulating across NZ, pushing you to fix a supposed payment failure before your service is suspended.
You may receive an email with a blank subject, appearing to come from grupo-conde.com and styled as an official Microsoft 365 Australia and New Zealand notice. It claims your Microsoft 365 payment could not be processed, warns of suspension and data expiry, and pushes you to update billing details or act urgently to keep your service active.
What makes this one harder to spot is that the email can pass normal authentication checks, so your mail system may not flag it as suspicious. That does not make it genuine. The sending domain is not a Microsoft domain, and the branding in the message does not match who actually sent it. If the message asks you to trust the logo and urgency over the real sender address, that is your warning sign.
The attacker is likely after your Microsoft 365 login, payment details, or both. If you click through and enter anything, you could hand over access to your email, files, contacts, and business systems, or expose your card details to fraud.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Look closely at the real sender address, not just the branding in the email. A Microsoft billing notice should not come from an unrelated domain.
- Do not: Click links or enter passwords or payment details from an unsolicited billing email, especially one using urgency about suspension or data expiry.
- Check: Verify your Microsoft 365 billing status by signing in through your usual saved bookmark or the official Microsoft site, not through the email.
- Report: Send the message to your IT provider or security team so they can block similar emails and check whether anyone has already interacted with it.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
See what a genuine Microsoft message looks like, the real sender domain, the real link destination, and where to report a fake.