Imagine one of your staff gets a phone call from “IT support” saying there’s a problem with their Microsoft 365 account and they need to verify a code or reset a password right now. It sounds routine. It sounds helpful. But increasingly, it’s a scam designed to hand your entire email system over to a criminal – and it’s happening to businesses of all sizes, not just big corporations.
Security researchers recently detailed a widespread campaign doing exactly this, primarily targeting directors, managers and other staff with access to sensitive information, using fake IT help desk calls to steal Microsoft 365 credentials and then extort the victim organisation. While the reported cases have focused on larger companies, the technique itself is cheap, effective, and completely scalable down to a five-person office in Traralgon or a professional services firm in Warragul.
How the Scam Actually Works
This isn’t a clumsy “your computer has a virus” robocall. It’s a carefully staged social engineering attack that plays out in steps:
- The call: Someone rings claiming to be from your IT provider, Microsoft, or an internal help desk. They often already know some real details about your business – your company name, maybe a staff member’s role – gathered from LinkedIn or your website, which makes them sound legitimate.
- The urgency: They claim there’s a security issue, a login problem, or a required “verification” that needs to happen immediately.
- The trick: They guide the victim through steps that either capture their login credentials directly, or trick them into approving a multi-factor authentication (MFA) prompt or entering a one-time code into a fake site.
- The takeover: Once inside, the attacker often logs in through a residential proxy service, making their sign-in look like it’s coming from an ordinary home internet connection rather than an obvious overseas server – so it doesn’t trigger the usual “suspicious login” red flags.
- The theft and extortion: From there, attackers quietly comb through emails and SharePoint files looking for anything sensitive – financial records, client data, contracts – before threatening to leak or sell it unless paid.
What makes this particularly dangerous is that it bypasses a lot of the technical defences businesses have already put in place. As reported by The Hacker News, attackers are specifically using adversary-in-the-middle techniques to intercept MFA approvals in real time, meaning even businesses that have “turned on MFA and ticked that box” can still be caught out if a staff member is talked into approving the wrong prompt.
Why Small Businesses Are Attractive Targets
It’s tempting to think this is an “enterprise problem.” It isn’t. Regional small businesses are often more vulnerable, not less, for a few reasons:
- Staff wear multiple hats and are less likely to have been through formal security awareness training.
- There’s often a genuine external IT provider, so a call claiming to be “IT support” doesn’t sound out of place.
- Smaller teams mean there’s less chance a second person will double-check an unusual request before it’s actioned.
- Many SMBs assume they’re “too small to be worth hacking” – which is exactly the assumption attackers rely on.
Once an attacker has one compromised Microsoft 365 mailbox, they often have access to invoicing history, client contact lists, and enough context to launch convincing follow-on scams against your customers and suppliers too – multiplying the damage well beyond your own business.
What This Means for Your Business
The core problem here isn’t a software bug you can patch. It’s a trust exploit – the attacker is relying on a staff member believing the caller really is from IT. That means the fix has to combine both technology and people.
Practical Steps You Can Take Now
- Set a verification rule: Make it official policy that no one resets a password, approves an MFA prompt, or shares a code over the phone based on an unsolicited call – full stop. If someone claims to be IT support, staff hang up and call your provider back on a known number.
- Talk to your actual IT provider: Confirm with them exactly how they would legitimately contact your staff, so everyone knows what a real request looks like versus an impersonation.
- Use number-matching MFA where possible: Modern MFA apps can show a number on the login screen that the user must match on their phone, rather than a simple “approve/deny” tap. This makes it harder for attackers to trick someone into approving a login they didn’t initiate.
- Limit standing access: Review who has access to sensitive files and mailboxes. Not every staff member needs access to everything, all the time – reducing access limits the damage if one account is compromised.
- Enable sign-in alerts and geo-based conditional access: Microsoft 365 can flag or block logins from unexpected locations or unfamiliar devices. Ask your IT provider to confirm this is switched on for your tenant.
- Brief your team, especially managers: A five-minute conversation about this exact scam – “if IT calls you out of the blue asking for a code, it’s not really IT” – is often more effective than any technical control.
- Have an incident plan: Know who to call and what to do if someone realises, even hours later, that they gave away a code or password. Speed matters enormously in limiting the damage.
Don’t Wait for a Close Call
Scams like this succeed because they’re built around a moment of pressure and politeness – most people don’t want to be the one who was rude to “IT support” and caused a problem. Building a culture where it’s completely normal, even encouraged, to say “I’ll call you back on our usual number to confirm” removes that pressure entirely.
Microsoft 365 has become the digital front door for most small businesses – it holds your email, your files, your calendars and often your client relationships. Treating a phone call requesting access to it with the same scepticism you’d apply to someone asking for your bank PIN is no longer overly cautious. It’s simply the standard of care small businesses now need in order to keep operating safely.
Worried This Could Affect Your Business?
If you’re not sure whether your business is exposed to this kind of risk, Maximum IT Solutions offers a free security assessment for businesses across Gippsland and regional Victoria. We’ll review your current setup and flag anything that needs urgent attention — no obligation.
Book your free security assessment →
