Microsoft 365 renewal lure
A slick fake Microsoft 365 email is circulating across NZ, pushing you to review a premium subscription before your data is supposedly lost.
You might receive an email with the subject "Important Notification : Data Loss Prevention , Renew Your Premium Subscription ." It presents itself as a Microsoft 365 data protection alert and warns that your storage or premium subscription needs immediate attention. The message pushes you to review or renew your subscription, using fear about data loss to rush you into clicking before you stop to think.
What gives it away is how the technical checks do not line up with the story the email is telling. It can slip through some mail checks and look superficially legitimate, but the sending setup still does not fully stack up, which is a strong sign the sender is not who they claim to be. The domain behind it has no established history as a trusted Microsoft sender, so you should treat the branding in the message as theatre, not proof.
The attacker is after your Microsoft 365 sign-in details, or any action that gets you onto a fake renewal page. If you click through and enter your credentials, they can use them to access your email, business files, and cloud services, then send further phishing from your account or lock you out.
This campaign has already been observed across multiple NZ organisations in the last day, so you should expect more of these messages to appear. If you see this subject line or a Microsoft 365 warning from an unrelated domain, do not engage with it.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Look closely at any Microsoft 365 renewal or data protection email, especially if it comes from a domain that is not clearly connected to Microsoft.
- Do not: Click links or enter your Microsoft 365 password from an email that pressures you with urgent claims about storage, billing, or data loss.
- Verify: Open Microsoft 365 directly in your browser or app and check subscription or storage notices there, rather than through the email.
- Report: Send suspicious messages to your IT provider or security team so blocking and mailbox checks can be carried out quickly.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
See what a genuine Microsoft message looks like, the real sender domain, the real link destination, and where to report a fake.
The Local Vocal is published by Decision1 IT Solutions. If one of these landed in your inbox, or someone in the team clicked, give us a call.