High riskEmail

Teams Notification Email Scam

This scam emails a fake notification that you have a new Microsoft Teams or Slack message or missed call, linking to a fake login page that captures your work credentials.

Quick verdict

Risk level
High risk
Scam type
Collaboration tool impersonation phishing
Main red flag
An email says you have a new Teams or Slack message and links you to log in to read it.
What to do first
Do not use the link. Open Teams or Slack directly through the app.

What this scam usually looks like

This scam emails a fake notification that you have a new Microsoft Teams or Slack message or missed call, linking to a fake login page that captures your work credentials.

Email scams, or phishing, remain one of the most common ways criminals steal logins, payment details, and money. A convincing message imitates a brand or contact and steers you toward a fake login page, a malicious attachment, or a fraudulent payment.

The single clearest warning sign to remember is this: An email says you have a new Teams or Slack message and links you to log in to read it. Do not use the link. Open Teams or Slack directly through the app.

Not sure this matches what you received? Compare it with the Fake Zoom Invite Scam or the SharePoint Phishing Scam, browse the Email Scams guides, or paste the exact message into our free scam checker.

By the numbers

Most reported
phishing was the most common type of cybercrime complaint reported to the FBI in 2023
Source: FBI Internet Crime Complaint Center
$12.5B
total reported internet-crime losses in the US in 2023
Source: FBI Internet Crime Complaint Center

Example message pattern

Example pattern, not a real report
Example pattern: 'You have 2 new messages in Teams. Sign in to view them before they expire: [suspicious link]'

This is a fictional, anonymised example used to illustrate the pattern. It is not a verified real message, and any names are used only to show how the scam typically reads.

Why this is a red flag: An email says you have a new Teams or Slack message and links you to log in to read it.

Red flags to watch for

  • A message or missed-call notification urging you to log in
  • A login page that is not the official tool
  • Pressure that messages will expire
  • A sender address that is external or slightly off
  • Requests for your work credentials

What to do

  • Open Teams or Slack directly through the app, not the email
  • Verify messages within the official tool
  • Report the email to your security team
  • Enable multi-factor authentication on work accounts

If you already clicked or replied

  • If you entered your work login, tell IT and change it immediately
  • Enable multi-factor authentication and review sessions
  • Remove unknown connected apps
  • Alert colleagues who may have received it

What not to do

  • Do not log in through message-notification email links
  • Do not share work credentials
  • Do not ignore a possible compromise; report it

Similar scams

Medium risk Email

Fake Zoom Invite Scam

This scam sends a fake Zoom, Teams, or video meeting invite by email and urges you to join or review a missed meeting through a link that leads to a fake login page built to capture your work or email credentials.

Created by Scam or Safe Editorial Team
Medium risk Email

SharePoint Phishing Scam

This scam sends a fake Microsoft SharePoint or OneDrive email saying a document has been shared with you, linking to a counterfeit Microsoft login page designed to steal your work email credentials. It is commonly aimed at businesses.

Created by Scam or Safe Editorial Team
High risk Email

Microsoft Account Email Scam

This scam sends a fake Microsoft or Outlook email about an unusual sign-in or an account about to be closed, linking to a fake Microsoft login page that captures your email and password.

Created by Scam or Safe Editorial Team

Frequently asked questions

Do Teams or Slack send login links by email?
Notifications may arrive, but you should open the official app to read messages, not log in through an email link. Treat such links as phishing.
Why target work logins?
Work credentials can unlock email, files, and company systems, enabling wider attacks. That makes them valuable to scammers.
I entered my login. What now?
Tell your IT or security team immediately, change your password, enable multi-factor authentication, and review sessions and connected apps.
How do I read messages safely?
Open the official Teams or Slack app directly and view messages there, ignoring email links.

Last reviewed June 2026 · Written & reviewed by the

Disclaimer: This page provides educational information only to help you recognise common scam patterns. It is not legal, financial, cybersecurity, or law enforcement advice, and it does not confirm whether any specific message, company, or person is genuine or fraudulent. When in doubt, contact the official organisation directly and report concerns to your local authorities.