Scammers Found the Company Door in Microsoft Teams

Fraudsters are using Microsoft Teams and other enterprise communication services, including Webex, to target people in China and steer them toward large transfers. One victim identified as Zhao told WIRED that a scammer moved their conversation to Teams, promoted a cryptocurrency investment, and disappeared after she borrowed from several banks to invest. Other victims reported losses ranging from $1,500 to $300,000.

The mechanism is social engineering. The fraudster supplies the story, the urgency, and the destination for the money. But the platform supplies a room that looks organized. A meeting invitation, a company logo, a familiar login screen, and the implied hierarchy of workplace software can make a stranger’s instructions feel as if somebody upstream has already checked them.

That borrowed authority matters in China, where victims described being told to use credentials provided by scammers. Zhao said she could no longer access the account afterward and therefore could not give police the chat history. The same feature that let the scammer control entry also helped control the record. The conference room became a costume department, then a locked evidence cabinet.

This does not make Microsoft or Cisco the author of every lie told through their products. General communication tools will always carry some abuse, and vendors cannot inspect every romance, investment pitch, or payment request without creating a different surveillance problem. Product responsibility begins at a narrower point: whether the service detects known patterns, identifies who controls an account, preserves evidence, and warns a person when an invitation or login arrangement departs from ordinary use.

There are practical controls. Platforms can place prominent warnings on accounts created or provisioned by another user, make external participants unmistakable, interrupt conversations that abruptly combine supplied credentials with financial solicitation, and provide victims with a secure route to recover records. Employers can require a second approver and verification through a separately obtained phone number before unusual transfers. Banks can slow exceptional payments long enough to confirm the recipient.

The burden cannot remain with a frightened user decoding tiny interface signals while a practiced fraudster supplies urgency. Chinese law-enforcement bureaus and the professional network Maimai have reportedly issued warnings that name Teams, Skype, or related terms. That is evidence of a repeated pattern, not proof that every user has received an effective warning at the moment it matters.

Microsoft and Cisco should now disclose how they label externally controlled accounts, retain abuse evidence, and respond when victims lose access. Employers and banks should state who reimburses a worker or customer when a transfer passes ordinary controls because a trusted corporate room helped stage the request. The next loss will test whether those institutions changed the mechanism or merely updated the warning page.