Fake IT Support on Microsoft Teams: How to Spot and Stop the Scam

Why Fake IT Support on Microsoft Teams Is Now a Real Threat

A message pops up in Microsoft Teams. It says it is from IT support, and it looks like it. The name reads “Help Desk” and the tone is friendly and urgent. Within minutes, the caller asks you to share your screen or approve a sign-in.

This is one of the fastest-growing scams targeting businesses. Attackers no longer need to get past your email filters. They simply message your staff directly in Teams.

How common are fake IT support messages on Teams?

More common than most businesses realise. Research from security firm Ontinue, reported by Security Magazine in October 2026, found that around 30% of organisations saw at least one external Teams contact showing signs of IT support impersonation in the first half of 2026. Roughly one in every 990 external Teams contacts showed at least one warning sign.

Why are attackers using Teams instead of email?

Because people trust Teams more. Staff are trained to be suspicious of email, but Teams feels like an internal tool. A chat that looks like it comes from your own helpdesk rarely raises the same alarm.

Where to start

If you are not sure how your Teams is set up, our Microsoft Teams solutions for business London service can review it. You can also see our wider cyber security services London.

How the Fake IT Support Scam Works

The details vary, but most attacks follow the same pattern. Microsoft has documented it in detail in its threat intelligence research, linking it to a group that deploys ransomware.

Step by step, what does the attacker do?

1. They create a problem. Some attackers first flood your inbox with junk email by signing you up to hundreds of mailing lists.
2. They offer to fix it. A Teams chat or call arrives from an account named something like “Help Desk” or “IT Support”.
3. They move quickly to a call. The chat escalates to a voice call, often with repeated attempts if you do not answer.
4. They ask for access. You are asked to open a remote support tool, such as Quick Assist, and share a code or approve control of your screen.
5. They take over. Once inside, they can steal passwords, change MFA settings and install malware or ransomware.

Why do the accounts look so convincing?

Attackers set up their own Microsoft 365 accounts and give them internal-sounding names. In Teams, these can look very similar to a colleague at first glance. Some also use AI to copy writing styles or even voices.

What is Quick Assist, and why do attackers use it?

Quick Assist is a remote support tool built into Windows. It is legitimate and useful, which is exactly why attackers like it. Persuading someone to open it gives the attacker a real, trusted way onto the device.

The Warning Signs to Look Out For

Most of these scams can be spotted if staff know what to look for. Pausing for a few seconds is often enough.

How can you tell a real IT support message from a fake one?

• The message is marked External in Teams, even though it claims to be internal
• You did not ask for help, but someone is offering it
• The person is in a hurry and wants to act straight away
• They ask you to open a remote tool or read out a code
• They ask you to approve a sign-in or reset your MFA
• Your inbox has just been flooded with junk email

What should staff do if they get one of these messages?

Stop, and do not share your screen or any codes. Contact your IT team through a number or channel you already know, not the one in the message. Then report the message so others can be warned.

Would your real IT provider ever contact you this way?

Your genuine IT support should have a clear process, usually starting with a ticket you raised. If someone contacts you out of the blue asking for access, treat it as suspicious until you have checked.

How to Protect Your Business From Teams Scams

Training helps, but the strongest protection combines people, settings and monitoring. Most of these steps can be done in Microsoft 365 without buying anything new.

1. Restrict external access in Teams

By default, Teams can allow chats from people outside your organisation. Limit external access to the organisations you actually work with, and decide whether chats from unmanaged personal accounts should be allowed at all.

2. Control remote support tools

Microsoft recommends removing or blocking Quick Assist if your business does not use it. If you use another approved remote support tool, make it the only one allowed. That way, an attacker cannot simply ask a user to open a tool that is already installed.

3. Use a clear support process

Agree that IT support will only act on requests that come with a ticket, or that are confirmed through a known channel. Make sure every member of staff knows this rule.

4. Protect sign-ins with strong MFA

Treat password resets, MFA changes and new device sign-ins as high-risk actions. Phishing-resistant methods, such as passkeys for business, make it much harder for attackers to hijack an account. Our MFA solutions for business London can help you set this up properly.

5. Train staff on what these scams look like

People are your first line of defence. Short, regular training with real examples works best. Our cyber security training for employees covers this type of attack, and our guide to 12 types of social engineering attacks explains the wider tactics.

6. Monitor for suspicious activity

Look for warning signs such as new external contacts with support-style names, a remote tool opening unexpectedly, or an MFA change straight after a Teams call. Our MDR services London watch for exactly these signals around the clock.

Applying Zero Trust to Collaboration Tools

Many businesses apply strict security to email and admin accounts, but treat Teams as safe by default. That gap is exactly what these attackers exploit.

What does zero trust mean for Teams?

Zero trust means never assuming a message, user or device is safe just because it appears inside your systems. Every request for access is checked. A zero trust security approach applies the same thinking to Teams as to everything else. Our article How Zero Trust Strengthens Cyber Security explains the idea in more detail.

Is Microsoft Teams itself unsafe?

No. Teams is a secure platform when it is configured well. The risk comes from default settings and from people being tricked. Our article Is Microsoft Teams Secure? covers the main settings, and our list of 10 Microsoft 365 security mistakes we see in London SMEs highlights common gaps.

Does this affect Cyber Essentials?

It can. Cyber Essentials covers user access control and protection against malware. Unrestricted external access and unmanaged remote tools make both harder to demonstrate, so it is worth reviewing them before your next assessment. The rules have also tightened recently, as our guide Cyber Essentials Has Changed explains.

What to Do If Someone Has Already Given Access

Mistakes happen. Acting fast makes a big difference to the outcome.

What are the first steps?

1. Disconnect the device from the network straight away
2. Tell your IT team or provider immediately
3. Reset the user’s password and sign them out of all sessions
4. Check for MFA changes and remove any methods the user did not add
5. Scan the device for malware before it reconnects

Will we need to report it?

If personal data may have been accessed, you may need to report it to the ICO within 72 hours under UK GDPR. This is general guidance, not legal advice, so check with your data protection lead. Our guide to data-centric security covers how to respond to a breach.

Make Teams Safe Without Slowing Your Team Down

Fake IT support scams work because they feel normal. A few settings changes, a clear support process and some well-targeted training make them far harder to pull off, without getting in the way of everyday work.

How Speedster IT can help

Speedster IT helps London businesses lock down Microsoft Teams, control remote access tools and train staff to spot these scams. Start with a Free Cyber Security IT Audit.

Call us on 0204 511 9111, email hello@speedster-it.com or get in touch today.

Louise

With over 15 years at Speedster IT, I’ve built a career around helping businesses navigate the evolving world of technology. I publish all the content for the IT Support London Blog and Cyber Security Blog, where I share practical insights on infrastructure upgrades, cybersecurity trends, and smart IT strategies for growing companies.