Microsoft's global outage has created an opening for phishing scams. Emails promising to restore Outlook access, verify mailboxes or arrange refunds should be treated with caution. Microsoft 365 was still experiencing disruption on November 13, with recovery incomplete. Users should avoid email links claiming to fix their accounts and check updates through Microsoft's official channels instead.
An email promising to restore your Outlook account or refund you for Microsoft's global outage could cost you more than a missed workday. Scammers may use the disruption to impersonate Microsoft support, send fake password-reset links and offer refunds to users waiting for their email services to return. Microsoft is gradually restoring its services, but the outage has not been fully resolved as of Friday, November 13.
The disruption began around 11:17 a.m. EST on Thursday, November 12. Outlook users across the US reported problems opening inboxes, sending emails and accessing their accounts. Downdetector recorded nearly 130,000 Outlook problem reports shortly after 1 p.m. EST.
Microsoft's recovery efforts have started showing results. Its latest update on Friday said service availability was improving across North America, with progress also reported in Europe and Asia-Pacific.
Watch out for messages claiming that your Outlook account needs immediate verification because of the outage. Other emails may promise compensation, a subscription refund or priority technical support.
These messages can use Microsoft's logo, familiar branding and language that looks like an official service notification. Their real purpose may be to collect login credentials, payment details or personal information.
Some common warning signs:
Fake Outlook recovery links: Messages ask you to sign in again to restore your mailbox. The link leads to a website designed to steal your Microsoft password.
Refund offers: An email promises money back for the hours Outlook was unavailable and asks for bank or card information.
Urgent account warnings: Messages threaten account suspension unless you verify your identity immediately.
Fake Microsoft support calls: Someone claims to be an engineer and offers to repair your Outlook account remotely.
Payment requests: A supposed technician demands a fee, gift cards or cryptocurrency to restore access.
The US Federal Trade Commission warns that tech-support scammers impersonate well-known companies, including Microsoft. They may ask victims to install remote-access software, disclose financial information or pay for unnecessary services.
Microsoft has service-level agreements for eligible business and enterprise subscriptions. Customers may qualify for service credits if an incident breaches the applicable service commitment. These credits are subject to the terms of the specific product and subscription.
They are not automatic cash payments to every Outlook user. Personal Outlook.com and Hotmail users should not assume they are entitled to an outage refund.
Businesses should retain incident records and check the applicable Microsoft service agreement before submitting a claim. The two incident references are EX1550543, covering Exchange Online, and MO1550821, covering the wider Microsoft 365 disruption.
Microsoft has published guidance on identifying genuine support communications. Its support documentation lists domains such as microsoft.com, microsoftsupport.com and mail.support.microsoft.com among its legitimate support email domains.
A familiar sender name alone is not enough to establish that a message is genuine. Scammers can imitate company branding and manipulate sender details.
Microsoft also makes one important point: it does not proactively contact people with unsolicited technical-support offers. Genuine Microsoft error messages do not provide a phone number and ask users to call for an urgent repair.
If you receive an unexpected call from someone claiming to be a Microsoft technician, do not give them access to your computer. Do not share passwords, verification codes or payment information.
Do not click the link or open attachments. Do not reply to the sender.
Instead, open a new browser window and type Microsoft's official website address yourself. Check your account and service updates through Microsoft's own channels.
If you have already entered your password on a suspicious website, change it immediately through the official Microsoft account page. Change the same password on other accounts if you have reused it. Turn on multifactor authentication and review recent sign-in activity.
If you have shared bank or credit card details, contact your financial institution immediately. Ask it to monitor the account and block suspicious transactions.
US users can report suspected fraud through the Federal Trade Commission's official website, ReportFraud.ftc.gov. Suspicious Microsoft support activity can also be reported through Microsoft's scam reporting page.
Microsoft says recovery is progressing across North America, Europe and Asia-Pacific. Email delivery and service availability have improved in several regions, but some customers may still experience intermittent access problems.
The company has not announced a final restoration deadline. Its engineers are working to stabilise affected infrastructure and clear delayed email queues.
The wider incident has affected Outlook, Exchange Online, Teams, SharePoint, OneDrive, Copilot and other Microsoft 365 services. Teams messaging and online meetings have largely remained functional, although calendar access and meeting scheduling have faced problems.
Microsoft has also said it has found no evidence of malicious activity behind the outage. The possibility of scammers exploiting the disruption is a separate security concern, not evidence that the outage itself was a cyberattack.
Users can follow live developments through the Microsoft 365 service health page.
