Phishing content detection in Microsoft Teams

Applies To
Microsoft Teams

Microsoft Teams uses AI-powered, context-aware detection to protect against potential phishing and social engineering activity in individual and group chats. Phishing content detection is available worldwide on Teams for desktop, web, and mobile.

How it works

After a conversation between you and a new external contact begins, Teams briefly analyzes the most recent message and conversational context to detect potential phishing content. This analysis takes place for a limited period of time.

If phishing is detected, you may receive a warning to help you make more informed decisions before continuing the chat. The warning is advisory and Teams doesn't automatically block the sender or take action on your behalf.

If you're using Teams for mobile in China, additional phishing and fraud protection may apply to internal and external conversations. This expanded coverage is designed to protect recipients from region-specific fraud patterns.

Note

  • Phishing content detection may not identify every phishing or social engineering attempt. Do not assume messages without phishing warnings are safe.
  • Phishing content detection isn’t used for training AI models, monitoring or summarizing conversation, providing productivity insights, advertising, or for other non-security purposes.

What to do when you see the banner

Screenshot of a Teams phishing attempt in a chat request from Microsoft Security, with a Preview their messages link.

Verify information

If Teams identifies a potentially harmful message, a warning will appear in the chat.

Screenshot of a Teams chat from external sender Micros0ft Security asking for credentials. This is flagged with a red phishing attempt warning.

Review the identity of the sender and their email address for potential impersonation. Also, review their message for any high-risk behavior, such as asking for money or requesting personal information.

  • If phishing is confirmed, don't engage with the sender. Block and report the user from their contact card.

  • If you believe a warning was shown incorrectly, go to the flagged message. Under More options, select Report this message. This feedback is used to monitor and improve detection quality.

Protect your information

Don't share:

  • Passwords

  • Verification codes

  • Financial information

  • Sensitive information

Prevent spam or phishing attempts from external chats in Microsoft Teams | Microsoft Support

High-risk warning banner in Microsoft Teams | Microsoft Support