Fake Microsoft warning wants you to panic click
Phishing emails are circulating across NZ pretending to be Microsoft 365 Support New Zealand, warning your data will be deleted unless you act.
You could receive an email with the subject line Final Data Protection Warning: Your data will be removed!, appearing to come from Microsoft 365 Support New Zealand. It impersonates Microsoft 365 and tells you your subscription is unpaid, your data is at risk, and you need to act now to avoid deletion. The message is designed to create panic and push you into clicking through or responding before you think it through.
What gives it away is that the message only partly lines up with who it claims to be. Some email checks passed, which helps it look legitimate at first glance, but the sending domain is not a normal Microsoft or New Zealand business domain, and one of the key checks still showed the sender was not fully authorised to send on behalf of that domain. That means the message can slip past basic trust signals while still failing the common-sense test of who should really be contacting you about a Microsoft 365 account.
The attacker is after your Microsoft 365 credentials, or any payment details you enter if you follow the prompt. If you click through and sign in, your email, files, contacts, and business conversations could be exposed, and your account could then be utilised to target other staff or customers. If you reply or engage, you also confirm your address is active and worth targeting again.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Review any recent Microsoft 365 billing or account warning emails carefully, and verify them by signing in through your usual Microsoft bookmark, not the email.
- Do not: Click links, open prompts, or enter passwords or payment details from unexpected account warning emails.
- Report: Send suspicious messages to your IT team or provider so they can block the sender domain and check whether anyone in your organisation engaged with it.
- Check: If anyone clicked or signed in, reset their Microsoft 365 password immediately and review recent sign-in activity for anything unrecognised.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
See what a genuine Microsoft message looks like, the real sender domain, the real link destination, and where to report a fake.