Microsoft Teams Adds AI Phishing Detection to Catch Scams Without Suspicious Links

Apparently, getting us called into another online meeting was not enough. Now the scammers want in, too.

Microsoft Teams is adding AI-powered phishing detection that examines the context of a conversation to spot impersonation, social engineering, and suspicious requests. For people using Teams at work, that could mean a warning when someone posing as technical support starts fishing for account access, even if they never send a malicious link or attachment.

Microsoft's rollout schedule calls for Targeted Release to begin in early November 2026 and finish by mid-November. Broader worldwide availability is expected between early and mid-December, covering desktop, Mac, mobile, and the web. Those are rollout targets, so everyone should not expect the feature to appear on the same morning.

Why Teams Phishing Needs More Than Link Scanning

We have spent years telling people to watch for suspicious links and unexpected attachments. That advice still matters, but a scammer does not need either one to get started. Social engineering is still the #1 staring point and sometimes the most dangerous thing is what seems like a simple request.

Imagine receiving a Teams message from someone calling themselves "IT Support." They say your account has been generating security alerts and offer to straighten things out. A few messages later, they ask you to approve a sign-in notification, read back a verification code, or let them remotely control your computer.

There may be no infected file to scan and no fake login page to block. The attacker is trying to talk you into opening the door yourself.

This is more than a hypothetical problem. That literally happed to one of my family members a few weeks ago. I won't say who **cough**Dad**cough to protect them, but it was a mess to clean up.

Microsoft has documented attacks involving fake IT support workers who approach victims through Teams and persuade them to grant remote access through legitimate support tools. The software can be perfectly legitimate. The person asking you to use it is the problem.

Workplace chat also gives the pitch a useful disguise. A message arriving in the same application you use for coworkers, customers, and meetings can feel far more official than all the suspicious email that we have gotten used to.

What Microsoft's New Protection Looks For

According to Microsoft's support documentation, the new protection uses AI to examine conversation context for phishing-related behavior. For most users, its initial focus is one-on-one and group chats involving new external contacts, meaning people contacting you from outside your organization.

The idea is to recognize a suspicious interaction even when the usual clues, such as a known malicious website or attachment, are missing. If Teams identifies a potential phishing attempt, it can display a warning in the chat so you can investigate before continuing.

There is an important limit here. Microsoft is not describing universal protection for every conversation with every coworker. A familiar account that has been compromised still deserves scrutiny when it suddenly starts requesting unusual payments, sensitive files, or account access.

Microsoft also says detection may initially operate in the background during quality validation without displaying warnings. No administrator action is required to enable the protection.

What About Privacy?

Any announcement involving AI examining conversations deserves a privacy question or two. "Trust us, it has AI" is not much of an explanation especially coming from companies who have displayed questionable concern for user privacy in the past.

Microsoft says this detection capability is used for security protection, rather than advertising, employee monitoring, productivity analysis, conversation summaries, or AI model training. Its rollout notice also says customer message content is not retained by the detection system for model training or other secondary uses.

That describes the purpose and handling of this particular security feature. It should not be read as a promise that Teams conversations are never stored elsewhere or that an employer's existing retention policies have disappeared, so keep that in mind when you are on the company dime.

A Phishing Warning Is a Reason to Stop and Check

A warning does not prove the sender is a criminal. Equally, the absence of a warning does not give a conversation a clean bill of health. Automated detection can miss an attack or flag an innocent message.

If Teams displays a warning, check the sender's identity and email address, then consider what they are asking you to do. A familiar display name, company logo, or profile photo is easy to copy. Knowing your boss's name is not particularly impressive when it is sitting on the company website.

For a confirmed scam, Microsoft says you can block and report the sender from their contact card. If you independently verify that a warning was triggered incorrectly, open the flagged message's More options menu and select "Report as not a concern."

The key word is independently. Asking the suspicious person whether they are really from IT is unlikely to produce a surprise confession.

Three Requests That Should Make You Pause

• Hand over account access. Do not share passwords or sign-in verification codes, and do not approve an unexpected authentication prompt because someone in chat tells you to. Contact your actual IT department through its established support channel.
• Move money or sensitive information. Treat unexpected requests for payments, changed bank details, gift cards, cryptocurrency, or confidential documents as something to verify through a separate, trusted channel.
• Give someone control of your PC. An unsolicited request to launch Quick Assist, install a remote-access application, or approve screen control deserves a hard pause. Verify who requested the session before allowing access.

Use a phone number, support portal, or other contact method you already trust. A phone number supplied by the person you are investigating simply gives the same scam another place to continue.

Learn the Scam Before Someone Tries It on You

This is also a good reminder that phishing is not confined to email. The delivery method can change from an inbox to a chat window or a phone call, while the underlying pitch stays familiar: trust me, hurry up, and give me something you normally would not.

If you would like to spend a little more time learning how to recognize these attempts, check out my Guide to Phishing on Buy Me a Coffee. It supports what we do here at MajorGeeks, and I would much rather help you spot the scam beforehand than hear about the mess afterward.

Geek Verdict

Microsoft's new Teams protection could provide a useful interruption at exactly the right moment. Its initial scope is limited, though, and a warning still leaves you with a decision to make. When an unexpected "help desk" contact wants your login code or control of your computer, take a minute to call the real help desk. A little inconvenience beats giving a stranger the keyboard. We wish Facebook would take a look at this and integrate this sort of concept into Messager which has had this sort of issue for, well forever.. .

Looking for suspicious behavior alongside suspicious links makes sense. Be vigilant.

Jim McMahon Jim McMahon, aka Corporal Punishment, is the founder of MajorGeeks.com. He has spent decades testing software, troubleshooting Windows, and helping users cut through the nonsense. He loves real freeware, hates bloatware, and runs on caffeine, sarcasm, and questionable choices.