# Fake Microsoft Teams chat notification emails: how to tell if one is real

URL: https://iblockspam.com/blog/fake-microsoft-teams-chat-notification-email
Last updated: 2026-11-03
Published: 2026-11-03
Topic: Phishing & threats
Author: iBlockSpam Team

> Is that 'new messages in Teams' email real? How genuine missed activity emails look, how fakes steal Microsoft 365 logins, and what to do if you clicked.

## Short answer

Microsoft Teams does send real "missed activity" emails, by default from no-reply@teams.mail.microsoft, summarizing chats you haven't read. Fakes copy them to send you to a fake Microsoft 365 sign-in page. Don't use the email's buttons. Open the Teams app yourself and look for the chat. If it isn't there, the email is fake: report it.

"You have 3 unread messages in Microsoft Teams. Reply now." Microsoft really sends emails like this, which is why attackers copy them. A fake Teams notification leads to a page that looks like Microsoft 365 sign-in and captures your work password. This guide explains what a genuine Teams email looks like, how to check one in under a minute, and what Microsoft 365 admins can do.

## What is a fake Microsoft Teams chat notification email?

A fake Microsoft Teams chat notification is a phishing email made to look like Teams telling you about unread messages, a missed chat, a voice message or a file shared in a chat. Its "Reply in Teams" or "View message" button opens a fake Microsoft 365 sign-in page or downloads a file. Whatever you type goes to the attacker.

It's different from Teams phishing itself, where attackers message you inside Teams; our guide to [Microsoft Teams phishing through external access](https://iblockspam.com/blog/microsoft-teams-phishing-external-access) covers that. This guide is about the email that claims to come from Teams. The attack's real goal is usually your Microsoft 365 password; see [fake Microsoft login pages](https://iblockspam.com/blog/fake-microsoft-login-phishing) for how those pages work.

### Common versions of the lure

| Lure | What it says | What it wants |
|---|---|---|
| Unread messages | "You have 3 new messages from your manager." | Microsoft 365 password |
| Missed chat | "Sarah from Finance tried to reach you." | Password, sometimes a code |
| Shared file in chat | "A file was shared with you in a Teams chat: Invoice_Q4.pdf." | Password or a malware download |
| Voice message | "You missed a Teams call and have a new voicemail." | Password |
| Teams account problem | "Your Teams access will be suspended. Verify now." | Password and payment details |

Voicemail versions overlap with [voicemail phishing emails](https://iblockspam.com/blog/voicemail-phishing-emails), and file versions with [file-sharing notification phishing](https://iblockspam.com/blog/file-sharing-notification-phishing).

## What does a real Microsoft Teams notification email look like?

A real Teams "missed activity" email is a summary of chats and mentions you haven't read while away from Teams. Microsoft's help says: "By default, you'll receive a missed activity email once every hour" for work and school Teams. Teams Free, for personal use, sends them daily by default ([Microsoft Support](https://support.microsoft.com/en-us/teams/notifications-settings/change-how-often-you-receive-missed-activity-emails-in-microsoft-teams); [Teams Free](https://support.microsoft.com/en-us/office/learn-more-about-missed-activity-emails-in-microsoft-teams-free-0c1c3712-5a06-4b7f-bd82-08b349800ecc)).

The sender matters. Microsoft's admin documentation lists "Teams missed activities" among system emails that are, by default, "sent from Microsoft no-reply product addresses, such as `no-reply@sharepointonline.com`, `no-reply@glint.mail.microsoft`, and `no-reply@teams.mail.microsoft`" ([Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/admin/email/select-domain-to-use-for-email-from-microsoft-365-products)). Microsoft can update this list, so check that page for the current addresses rather than relying on an old screenshot.

Two details catch people out:

- **Real ones are tagged External.** Microsoft says that because these come from Microsoft-owned system addresses, "recipients see them marked as [External] notifications in Outlook." The tag alone doesn't make a Teams email fake. See [Outlook's External tag explained](https://iblockspam.com/blog/outlook-external-email-warning-tag).
- **Your admin may have changed the sender.** The **Send email notifications from your domain** setting lets an admin send these notifications from your own company domain, for example `no-reply@yourcompany.com`, through your Exchange Online tenant.

### Real vs fake Teams notification emails

| Check | Real missed activity email | Fake Teams notification |
|---|---|---|
| Sender domain | teams.mail.microsoft, or your own domain if your admin set it | A lookalike, unrelated or hacked domain |
| The chat exists when you open Teams yourself | Yes | No |
| Asks you to sign in to read the message | No: messages are read in Teams | Usually |
| Deadline or threat of suspension | No | Common |
| Attachment in the email | Not normally | Sometimes an HTML, PDF or file link |
| Can you turn it off in Teams settings | Yes, under Missed activity emails | Not applicable |

### Example of a fake Teams notification email

This is an **example** written for this guide. It is not a real Microsoft email.

```
From: Microsoft Teams <notify@teams-msgcenter-alert.com>
Subject: You have 3 unread messages from David (Finance)

David Chen sent you a message:
"Can you approve the revised payment before 3pm?
 Details in the attached sheet."

[ Reply in Teams ]

You are receiving this because you have unread
messages in Microsoft Teams.
```

The tells: a sender domain that isn't Microsoft's or yours, money and a deadline in the preview, and a button that leads to a sign-in page instead of the Teams app.

## Why do attackers fake Microsoft Teams notifications?

Attackers fake Teams notifications because they're routine, they come from a brand everyone at work trusts, and they lead naturally to a Microsoft 365 sign-in page. A few things make them effective:

- **People expect them.** Most staff get real missed activity emails every day, so one more doesn't stand out. Hourly summaries are the default for work accounts.
- **The real ones look external.** Because genuine notices carry the External tag, users learn to ignore that warning on Teams emails, which removes one of their best clues.
- **The preview carries the pressure.** A fake can show a short "message" from a manager or the finance team asking for an urgent approval, which is the same pressure used in [business email compromise](https://iblockspam.com/blog/business-email-compromise-prevention).
- **One password opens a lot.** A Microsoft 365 sign-in usually reaches email, Teams, OneDrive and SharePoint, so a single stolen password lets the attacker read chats and send convincing messages to colleagues.

The fix is a habit rather than a skill: never read a Teams message through an email. Open Teams and look.

## How do I turn off or change Teams missed activity emails?

Fewer real notices make fakes easier to spot. For work and school Teams, Microsoft's steps are: select **Settings and more** > **Settings** > **Notifications and activity**, then under **Missed activity emails** choose how often you'd like to receive them ([Microsoft Support](https://support.microsoft.com/en-us/teams/notifications-settings/change-how-often-you-receive-missed-activity-emails-in-microsoft-teams)).

Microsoft's help for Teams for personal use (Teams Free) lists three places ([Microsoft Support](https://support.microsoft.com/en-us/office/learn-more-about-missed-activity-emails-in-microsoft-teams-free-0c1c3712-5a06-4b7f-bd82-08b349800ecc)):

- **Desktop:** **Settings and more** > **Settings** > **Notifications and activities**, then **Missed activity emails**.
- **Web:** **Settings and more** > **Settings** > **Notifications**, then **Missed activity emails**.
- **Mobile:** your profile picture > **Notifications** > **Other notification types** > **Emails**.

On that page the choices are **Once every hour**, **Daily** or **Off**; the options in a work account can differ. If you choose **Off**, any later email claiming to be a Teams chat summary deserves extra suspicion, though remember that other Microsoft 365 notifications, such as file shares, still arrive by email.

## How do I check if a Teams notification email is real?

Check in Teams itself. A real missed activity email only summarizes messages that already exist in your Teams chats.

1. **Don't use the email's buttons or attachments.**
2. **Open Teams yourself,** from the desktop app, the mobile app or by typing `teams.microsoft.com`.
3. **Look for the chat** in **Chat** and **Activity**. If the messages are there, read and reply in Teams. If nothing matches, the email is fake.
4. **Check the sender** against the table above. A Teams notice from a domain that isn't teams.mail.microsoft or your own is phishing.
5. **If a real chat is from someone outside your company,** be careful anyway. A genuine notification may summarize a message from an attacker who contacted you through Teams external access.
6. **Report the email** with Outlook's **Report** button. See [how to report a phishing email](https://iblockspam.com/blog/report-phishing-email).

To see exactly where a message came from, paste its headers into the free [Microsoft 365 Header Analyzer](https://iblockspam.com/tools/microsoft-365-header-analyzer), which decodes Microsoft's anti-spam headers and runs in your browser. Our guide to [reading Microsoft 365 spam headers](https://iblockspam.com/blog/microsoft-365-spam-headers-explained) explains the fields.

Microsoft gives the same two checks for its account security emails: confirm the sender's domain, and "view the email's message headers to be sure the email is from Microsoft" ([Microsoft Support](https://support.microsoft.com/en-us/account-billing/can-i-trust-email-from-the-microsoft-account-team-685fd302-f52f-1a9f-cc13-065dec46fe25)). For Teams notices, opening Teams yourself is quicker and settles the question.

## How do I report a phishing message inside Teams?

If the dangerous message is in Teams itself, report it there. Microsoft's steps: go to the chat or channel message, select **More options** > **Report this message**, choose the security concern option for "spam, phishing, or malicious content" and select **Report** ([Microsoft Support](https://support.microsoft.com/en-us/teams/chat/report-messages-in-microsoft-teams)). Microsoft says message senders aren't notified that their messages were reported ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/submissions-teams)).

Then tell IT, because an outsider who messages you has often contacted colleagues too, and an admin can block that domain for everyone.

## What should I do if I clicked or entered my password?

Act straight away. A stolen Microsoft 365 password gives access to email, Teams chats and files.

1. **Change your password** from a trusted device by typing the real sign-in address.
2. **Tell IT immediately,** and say whether you entered a code or approved a sign-in prompt. Fake pages can pass codes to Microsoft in real time; see [adversary-in-the-middle phishing](https://iblockspam.com/blog/adversary-in-the-middle-phishing-mfa-bypass).
3. **If you opened a downloaded file,** disconnect from the network and tell IT before doing anything else.
4. **Check for misuse:** inbox rules, forwarding, sent items and Teams messages you didn't write. [Signs your email account is compromised](https://iblockspam.com/blog/signs-email-account-compromised) lists what to look for.
5. **Follow the full checklist** in [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link).

## What should a Microsoft 365 admin do about fake Teams emails?

### 1. Send Teams notifications from your own domain

In the Microsoft 365 admin center, go to **Settings** > **Org settings** > **Organization profile** > **Send email notifications from your domain**, select **Use a custom send-from domain address**, choose a verified domain and select **Save**. Microsoft says the setting can take up to 24 hours to take effect, and recommends a domain with SPF, DKIM, DMARC and MX records in place ([Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/admin/email/select-domain-to-use-for-email-from-microsoft-365-products)). Microsoft Teams is on its list of supported products. After that, you can tell staff that real Teams notices come from your own domain, as internal mail. Check your domain's protection first with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker), so nobody can spoof that address.

### 2. Make sure users can report Teams messages

Teams user reporting depends on two settings. In the Teams admin center, the **Report a security concern** toggle in the messaging policy must be **On**. In the Microsoft Defender portal, go to **Settings** > **Email & collaboration** > **Teams user reported settings** and check **Monitor reported items in Microsoft Teams**; Microsoft says it's on by default for new tenants but existing tenants need to enable it. Microsoft documents this for organizations with Defender for Office 365 Plan 1 or Plan 2, or Microsoft Defender XDR ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/submissions-teams)). For email reporting, see [Microsoft 365 user reported settings](https://iblockspam.com/blog/microsoft-365-report-message-user-reported-settings).

### 3. Remove the emails and secure anyone who clicked

Find every copy by sender or subject and purge it; see [remove a phishing email from all mailboxes](https://iblockspam.com/blog/remove-phishing-email-from-all-mailboxes-microsoft-365). Block the sending domain in the [Tenant Allow/Block List](https://iblockspam.com/blog/microsoft-365-tenant-allow-block-list). For each user who entered a password, follow [Microsoft 365 compromised account remediation](https://iblockspam.com/blog/microsoft-365-compromised-account-remediation).

### 4. Limit who can reach staff on Teams

Fake notification emails and real external chats are often part of the same campaign. Restrict Teams external access to the domains you work with, as our [Teams external access guide](https://iblockspam.com/blog/microsoft-teams-phishing-external-access) explains.

### 5. Filter lookalike notices before they arrive

Most fake Teams emails come from newly registered lookalike domains or hacked mailboxes. An MX-level filter in front of Microsoft 365 checks inbound mail for phishing and spoofing and holds suspect messages in quarantine; our [Microsoft 365 built-in vs gateway comparison](https://iblockspam.com/compare/microsoft-365-built-in-vs-gateway) shows when that second layer helps.

## Next steps

1. Tell staff the rule: read Teams messages in Teams, never through an email's sign-in button.
2. Consider sending Microsoft 365 notifications from your own domain, then tell staff what real ones look like.
3. Confirm that users can report messages in both Outlook and Teams.
4. Check your domain with the free [DMARC Checker](https://iblockspam.com/tools/dmarc-checker), and see [iBlockSpam for Microsoft 365](https://iblockspam.com/platforms/microsoft-365) if fake Microsoft notices keep reaching inboxes.

## Frequently asked questions

### What email address do real Microsoft Teams notifications come from?

By default, Microsoft 365 sends system emails such as Teams missed activity summaries from Microsoft no-reply product addresses, and Microsoft's admin documentation gives no-reply@teams.mail.microsoft as an example. An admin can change this so notifications come from your own domain instead. A Teams notice from any other domain, especially a lookalike, should be treated as phishing.

### Why does a real Teams notification email show an External tag in Outlook?

Because it's sent from a Microsoft-owned system address, not from inside your organization. Microsoft says recipients see these notifications marked as External in Outlook. So the External tag doesn't prove a Teams email is fake. Admins can switch notifications to a verified company domain, which makes them internal and makes outside fakes easier to spot.

### Can I turn off Microsoft Teams missed activity emails?

Yes. In Teams, go to Settings and more > Settings > Notifications and activity, and under Missed activity emails choose how often you want them; Microsoft's Teams Free help lists Off as a choice. Microsoft says work accounts get one email every hour by default, while Teams Free sends them daily. Turning them off makes any later Teams email easier to judge.

### Can a genuine Teams missed activity email contain a phishing message?

It may. A missed activity email summarizes chats you haven't read, so if an outsider messages you through Teams external access and you don't open it, their text may appear in a real Microsoft email. Judge the message itself: anyone asking you to sign in, approve a prompt, install remote support software or pay is a red flag.

### How do I report a phishing message inside Microsoft Teams?

Hover over the message, select More options, then Report this message. Choose the security risk option for spam, phishing or malicious content, and select Report. Microsoft says senders aren't notified. If the option is missing, your admin may have turned off reporting, or your organization may not have it: Microsoft documents Teams reporting for organizations with Defender for Office 365 or Defender XDR.

## Sources

- [Microsoft Support: Change how often you receive missed activity emails in Microsoft Teams](https://support.microsoft.com/en-us/teams/notifications-settings/change-how-often-you-receive-missed-activity-emails-in-microsoft-teams)
- [Microsoft Support: Learn more about missed activity emails in Microsoft Teams Free](https://support.microsoft.com/en-us/office/learn-more-about-missed-activity-emails-in-microsoft-teams-free-0c1c3712-5a06-4b7f-bd82-08b349800ecc)
- [Microsoft Learn: Select the domain to use for email from Microsoft 365 products](https://learn.microsoft.com/en-us/microsoft-365/admin/email/select-domain-to-use-for-email-from-microsoft-365-products)
- [Microsoft Support: Report messages in Microsoft Teams](https://support.microsoft.com/en-us/teams/chat/report-messages-in-microsoft-teams)
- [Microsoft Learn: User reported settings in Teams (Defender for Office 365)](https://learn.microsoft.com/en-us/defender-office-365/submissions-teams)
- [Microsoft Support: Can I trust email from the Microsoft account team?](https://support.microsoft.com/en-us/account-billing/can-i-trust-email-from-the-microsoft-account-team-685fd302-f52f-1a9f-cc13-065dec46fe25)

## Free tools for this guide

- [Microsoft 365 Spam Header Decoder](https://iblockspam.com/tools/microsoft-365-header-analyzer): Paste Microsoft 365 headers to decode SFV, CAT, SCL, BCL and compauth reason codes in plain English — runs in your browser.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/fake-microsoft-teams-chat-notification-email (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt