Fake password expiry emails: is "your password expires today" real?

"Your password expires today. Click below to keep your current password." This is one of the oldest phishing emails in business inboxes, and it still works because password expiry used to be normal at work. Today the two biggest business email platforms don't send password expiry emails at all. This guide shows how to check in a minute, what a fake looks like, and what to do if you already clicked.

What is a fake password expiry email?

A fake password expiry email is a phishing message that claims your email or work password is about to expire and offers a button to renew it or "keep the same password". The button opens a fake sign-in page that looks like Microsoft 365, Outlook, Gmail or your webmail. Whatever you type there goes to the attacker.

It's a close cousin of the "mailbox full" scam, which our guide to mailbox full and account suspended phishing covers in depth. The FTC's description of phishing fits both: messages that "claim there's a problem with your account or your payment information" or "say you need to confirm some personal or financial information" (FTC).

Example of a fake password expiry email

This is an example written for this guide. It is not a real Microsoft or Google email.

From: IT Service Desk <no-reply@m365-passwordcenter.net>
Subject: Action required: password for jane@yourcompany.com expires today

Your mailbox password is set to expire on 11/03/2026.

To avoid losing access to email, Teams and OneDrive,
confirm your account below. You can keep your current
password.

[ KEEP CURRENT PASSWORD ]

If no action is taken within 24 hours, your account
will be signed out of all devices.

Microsoft 365 Security Team

The tells: a sender domain that isn't your company's or Microsoft's, a same-day deadline, a threat of lost access and, above all, the promise that you can keep your password by clicking. The checks below work even when a fake is polished.

Do Microsoft 365 passwords expire?

No, not by default. Microsoft's admin documentation says: "By default, passwords never expire for your organization." An admin can turn expiry on and pick a period between 14 and 730 days, but Microsoft labels the never-expire option as recommended (Microsoft Learn).

The same page contains the most useful fact for spotting fakes: "The Microsoft 365 admin center and Microsoft 365 productivity apps no longer support password expiration notifications." At the time of writing (November 2026), Microsoft 365 itself doesn't email users before a password expires.

There are two caveats worth knowing:

• Older tenants. Microsoft Entra ID documentation says the default is no expiration, but "If the tenant was created before 2021, it has a 90 day expiration value by default" (Microsoft Learn). Some older organizations still have expiry on without realizing it.
• Hybrid identity. The Microsoft 365 expiry setting covers cloud-only users. If your organization syncs accounts from on-premises Active Directory, the policy lives there, so ask IT how you'd be told.

In every case, a real expired password is handled on the real Microsoft sign-in page, when you next sign in. It isn't renewed by a link in an email.

Do Google Workspace passwords expire?

Not unless an admin turns it on. Google's admin help says: "Password expiration is turned off by default because research has shown little positive impact on security" (Google Workspace Admin Help).

If an admin does set an expiry period, Google says users get "pop-up alerts (but not email reminders) in their Google services" starting "30 days before the password expiration date". So a Gmail message saying your Google Workspace password expires tonight isn't the way Google warns users.

Why don't real services email you to keep your password?

Because expiring passwords is out of favor, and because emailing a "keep your password" link would train people to fall for phishing. The US government's identity guidance, NIST SP 800-63B, says in section 3.1.1.2: "Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically." It adds that they "SHALL force a change if there is evidence that the authenticator has been compromised" (NIST).

Microsoft says the same in its own words: "Microsoft's latest guidance discourages password expiration policies for cloud-only accounts. The recommended setting is for passwords to never expire" (Microsoft Learn). Its reasoning is that password change requirements lead to predictable passwords that are easier to guess.

And "keep your current password" makes no sense on its own terms. If a password really expires, the point is that you choose a new one. An offer to keep it only exists to get you to type it.

Why do password expiry scams still work?

Password expiry scams still work because many people remember a time when expiry was real. For years, workplaces made staff change passwords every few months, so a reminder email feels familiar. Older Microsoft 365 tenants may still expire passwords, which keeps the habit alive.

The scam also asks for very little. It doesn't want money or a new password, just the one you already have, and it frames typing it as the easy option. Attackers sometimes send it from a hacked mailbox at a real company, so it can pass authentication checks, and they write it in neutral IT language that fits any organization. The same campaign can go to thousands of domains with only the logo changed.

How do I check if a password expiry email is real?

Check outside the email. Use this procedure whenever a password, mailbox or account notice arrives.

1. Don't click anything in the message, including "unsubscribe" or "not you?" links.
2. Look at what it asks for. If it offers to keep, confirm or validate your password through a link, it's phishing. Stop here and report it.
3. Ask IT, or check the policy yourself if you're the admin. In the Microsoft 365 admin center, go to Settings > Org settings > Security and privacy > Password expiration policy. In the Google Admin console, go to Security > Authentication > Password management. If expiry is off, the email is fake.
4. If expiry is on and you want to change your password, type the sign-in address yourself, such as myaccount.microsoft.com or myaccount.google.com, and change it there.
5. Check the sender if you're curious, not as proof. Paste the headers into the free Email Header Analyzer to see the real sending domain and its SPF, DKIM and DMARC results. Our guide to reading email headers explains each line.
6. Report the message with the Report button in Outlook or Report phishing in Gmail. See how to report a phishing email.

Real vs fake password expiry notices

Why the sender address isn't enough

Fakes often come from a real, hacked mailbox at another company, so they can pass authentication checks. Others use display name spoofing, showing "IT Service Desk" over an unrelated address, or a lookalike domain. The question to ask is not "who sent this?" but "does my platform send this kind of email at all?" For Microsoft 365 and Google Workspace password expiry, the answer is no.

What should I do if I clicked or entered my password?

Move fast. A stolen work password is often used within hours to read mail, set up forwarding and send more phishing from your account.

1. Change your password from a trusted device, by typing the real sign-in address. Change it anywhere else you used it.
2. Tell IT immediately and say whether you also entered a code or approved a prompt. Fake pages can relay codes in real time; see adversary-in-the-middle phishing.
3. Check for signs of misuse: new inbox rules, forwarding, sent items you didn't write and unfamiliar sign-ins. Our guide to signs your email account is compromised lists them.
4. Follow the full checklist in what to do after clicking a phishing link.

What should admins do about fake password expiry emails?

Admins can make this lure fail by removing the thing it imitates, then cleaning up any copies that land.

1. Turn off password expiry and require MFA

If your tenant still expires passwords, follow Microsoft's recommendation and set passwords to never expire, paired with multifactor authentication. In the Microsoft 365 admin center, select Set passwords to never expire (recommended) under Password expiration policy. To check the domain setting from PowerShell, run Get-MgDomain from the Microsoft Graph PowerShell module and look at PasswordValidityPeriodInDays; Update-MgDomain changes it. Check the value your tenant actually returns rather than assuming a default: the Entra ID documentation says new tenants default to no expiration (90 days for tenants created before 2021), while the Update-MgDomain reference says a 90-day value is used if the property isn't set. In Google Workspace, leave expiry off unless a compliance rule requires it. Our guides to Microsoft 365 security defaults and MFA and Google Workspace 2-Step Verification enforcement cover the second half.

2. Tell staff, in one sentence, how real password changes happen

For example: "We never ask you to keep or confirm your password by email. If your password ever needs changing, you'll be asked when you sign in." Staff can then judge every future notice against that rule. Put it in onboarding and in your security awareness training.

3. Remove every copy and secure anyone who clicked

In Microsoft 365, find and purge the campaign with Threat Explorer or a content search; see remove a phishing email from all mailboxes. In Google Workspace, use the security investigation tool where your edition includes it. Then reset passwords and revoke sessions for anyone who entered credentials, using the steps in Microsoft 365 compromised account remediation.

4. Filter before the inbox

Most password lures arrive from new lookalike domains or hacked third-party mailboxes, and some hide the link in a PDF or QR code; see QR code phishing. An MX-level filter in front of Microsoft 365 or Google Workspace checks inbound mail for phishing and spoofing before delivery and holds suspect messages in quarantine. Our Microsoft 365 built-in vs gateway comparison explains when that extra layer is worth it.

Next steps

1. Check whether your organization expires passwords at all; if not, tell staff that every expiry email is fake.
2. If it does, move to never-expire plus MFA, as Microsoft and NIST recommend.
3. Send staff the one-sentence rule about how real password changes happen.
4. Run the free DMARC Checker on your domain so attackers can't send fake IT notices from it, and see iBlockSpam for Microsoft 365 if password lures keep reaching inboxes.