Do not use the email link to find out. Open Microsoft 365 from a known bookmark or type the address yourself. If no prompt appears in your account, the email was likely a credential-stealing attempt.
Why these messages work
Password-expiration warnings create urgency and lead to a convincing copy of Microsoft’s sign-in page. The fake page captures your password and may immediately request an MFA code.
Check it safely
- Close the email.
- Open a new browser window and go to
office.comyourself. - Check your account and security notices there.
- If you entered credentials on the email’s page, change your password from a clean device and contact IT immediately.
For organizations
Microsoft 365 administrators should review sign-in logs, MFA changes, inbox forwarding rules, and recently authorized applications after a suspected compromise. Changing the password alone may not remove an attacker’s persistence.
This page provides general security guidance, not a guarantee that any individual message is safe. When money, passwords, remote access, or sensitive records are involved, verify through a separate trusted channel.