Is this a Fake Email from Microsoft Regarding Purchasing Office 365

Question

Hello

I received an email today with the Subject Your Microsoft order on September 26, 2024

Sales Helpline : 1-(818) 746-3880

It shows an order was placed for Office 365 E3 (no Teams) Amount $747 Price $811.43

I did not place this order so I called the phone number. I spoke with Jonathan. He wanted to remote into my computer with aweray to help me cancel the subscription. I refused and I asked him if he could cancel on the phone and he told me no. At that point, I told him thanks for his help and disconnected the call.

Is this a fake email and why wouldn't I be allowed to cancel a subscription over the phone?

Please advise.

thank you

Answer 1

I got one of these "Your Microoft order" emails too today. Very well crafted: the formatting is convincing, the product names are real, and the link URLs look like legit Microsoft pages. Took me several minutes of looking before I was confident it was bogus.

For reference and googleability, here's the contact info they used in the email to me:

From: ******@saleteamm365.onmicrosoft.com

Sales Team Helpline : 1-(818) 835-5886
Billing profile: 
1224 N Sultana Ave
Ontario, ca, 91764-1810

---

Definitely bogus, I think.

For me, the main tell is that the From and To addresses use "*.onmicrosoft.com" domains instead of plain "*.microsoft.com" domains; in my case, "@saleteamm365.onmicrosoft.com". (And the use of "saleteam" instead of "salesteam".) The "*.onmicrosoft.com" domains are not Microsoft themselves; they are user domains for customers who have an Azure or M365 (Outlook Online) presence. Anybody with a credit card can get one of those, and choose the word that comes before the ".onmicrosoft.com" part. An "onmicrosoft.com" domain means nothing in terms of trustworthiness. Other minor tells are that the email doesn't actually include your subscription ID, your email is in a Bcc instead of the To, and the "sales team" contact info is slightly mis-formatted, with a lower case "ca" abbreviation for "California" and a nonstandard comma between the state and ZIP code.

The way the scam works is (I think) that all the links in the email go to legit Microsoft pages that are generic documentation about M365 accounts and admin tools, you won't actually see this purchase when using those tools for your M365 account (because the purchase and/or account doesn't exist), so you'll call the "support" phone number in the email to figure things out, and the scammer who answers will try to talk you in to giving them your credentials or access to your computer.

(At least, I think the links go to legit Microsoft doco pages, just by looking at their URLs. I didn't actually click anything in this email.)

---

The email (viewed in Mail.app on macOS 15):

Answer 2

A fake/scam phishing email, that wasnt MS you spoke to

Presumably you rely on Defender and have no main brand Av/Security utility

Answer 3

I received a very similar email today, Sept. 27, 2024 and have been searching hard to determine if this is legit. All the links and the sender email address all appear to be from Microsoft, (I did not click on any links, but using the mouse on my desktop I hovered over them and they all seem to be from MS), but the phone number, 818-338-6160, does not seem to be a legit Microsoft number.

I've checked my MS account and I didn't see this transaction, but I still took certain security measure regarding my account and I will ignore and delete this email.

Answer 4

I showed the email to our Security Team in my organization, and it appears the sender blind copied me along with many others. Reason why so many others are getting the same Scam email. People need to spend their time working for a living!

Answer 5

We've been receiving these phony invoices for over two months. All being sent from sketchy-looking M365 tenant domains, like taylorllc907.onmicrosoft.com, kambycakeshop.onmicrosoft.com to give two examples. The return path for these two examples was some bogus address at salesM365department.onmicrosoft.com. I opened a ticket with MS re: this almost a month ago. Outside of the initial ticket response, I've heard nothing regarding this and the ticket is still open. I just keep updating the ticket with more examples as they roll in each day. Somebody is gaming M365/Azure Apps?