Texts and emails

The Microsoft 365 Invoice Reattach Text Scam, October 2026 (52ch)

Updated 20 October 2026

You see a text about a Microsoft 365 invoice and assume your work email is the one that is being billed. That is the costly assumption. The message is a short, plain SMS with an attachment or a link, dressed in a Microsoft logo, and it lands on the one device every employee carries.

What the Microsoft 365 invoice reattach text looks like

You get a text from a number you do not recognise. The body is short. It says something like "Microsoft 365: your invoice for October has a reattach error, view the corrected PDF" or "Office 365 billing: invoice 773421 failed to attach, open the corrected version". Sometimes it names your business. Sometimes it just says "your tenant". The link is a shortener, a domain that looks like a CDN, or a freshly registered .shop. Inside, the PDF has the four coloured squares of the Microsoft logo and a line item for a few hundred pounds, dollars, or euros. The total is small enough that you would not rage at Accounts Payable over it. The PDF asks you to confirm bank details, a billing contact, or to log in to a portal that looks like the real Microsoft admin centre.

The reason this works in October 2026 is the same reason it worked in October 2023. Most people who handle invoices do not have the patience to log in to a real portal to check a number. They open the PDF. They forward it. They trust the logo. The scammers have spent the last two years rebuilding the look of a Microsoft invoice so the four coloured squares, the right typeface, and the right footer text all line up. Some of the latest versions even include a fake Microsoft 365 tenant ID at the bottom that matches the format Microsoft uses, and a support number that routes to a person who will politely reassure the caller that the invoice is real.

If you are reading this on a Tuesday morning in the second half of October, expect two waves. The first hits small business owners and the bookkeepers who handle their billing. The second hits individual Microsoft 365 Family subscribers who get a separate text framed as a refund instead of a charge. The wording shifts, the script does not.

The law the scammers are breaking, and the one they hope you break

In the United States, the relevant statutes are 18 U.S.C. § 1028 (fraud and related activity in connection with identification documents) and 18 U.S.C. § 1029 (access device fraud) for the card and bank detail harvesting, plus 18 U.S.C. § 1343 (wire fraud) and 18 U.S.C. § 1030 (computer fraud) for the portal that mimics Microsoft. Sending an unsolicited SMS with a malicious link is also covered by the Telephone Consumer Protection Act when the sender is a real business, which these are not. The relevant regulator is the Federal Trade Commission, which has been pressing junk-text cases under the Telemarketing Sales Rule since the 2024 amendments. Reporting at reportfraud.ftc.gov feeds the FTC's spam database, which is the largest in the country.

In the United Kingdom, the texts fall under the Fraud Act 2006 (Section 2, fraud by false representation) and the Computer Misuse Act 1990 (Sections 1 and 2, unauthorised access). The Information Commissioner's Office has jurisdiction over the unsolicited marketing element under the Privacy and Electronic Communications Regulations 2003. Reporting to Action Fraud at actionfraud.police.uk is the path that produces a crime reference number a bank will accept. Forward the original SMS to 7726, which is the free spam-reporting short code run by GSMA and the mobile carriers.

The law the scammers hope you break is your own internal control. If you process a fraudulent invoice and pay it, the loss is on the business. Most cyber insurance policies exclude losses that started with a finance team member overriding a procedure, and most procedures say you confirm vendor changes by a known phone number before you touch a bank account. The text is engineered to push past the procedure: short, urgent, with a logo that looks correct, and a dollar figure that does not trigger the kind of scrutiny a five-figure invoice would.

What to do in the next hour if you already opened the PDF

Stop. Do not pay anything. Do not call the support number in the PDF. Do not reply to the text. Open the real Microsoft 365 admin centre in a fresh browser tab and check the billing pane. If the invoice is real, it is there. If it is not, the text is a scam and the only action you need to take is containment.

Disconnect the device you used to open the PDF from the network. You want to break any session the portal may have opened. Wipe the browser profile you were using, including cookies, site data, and saved passwords. If the portal asked for a Microsoft 365 admin password, treat the account as compromised: force a password reset from a clean device, force a sign-out of all sessions, and review the audit log under the Microsoft Purview compliance portal for any sign-in you do not recognise. Turn on multifactor authentication if it is not already on, and prefer a hardware key or the Microsoft Authenticator app over SMS codes.

If the portal asked for a bank account, routing number, or vendor payment details, call your bank on the number on the back of the card, not any number in the text. Ask for a stop on any pending transfer and a flag on the account for fraudulent vendor changes. File a report with the FTC at reportfraud.ftc.gov and, if you are in the UK, with Action Fraud at actionfraud.police.uk. Keep the original SMS, the PDF, and any portal URL. You will need them for the bank, the insurer, and the police.

If the device is a work device, stop using it and call IT. The point of a finance-team compromise is not the device, it is the email tenant. IT will check inbox rules, OAuth grants, and any new forwarding rules on the affected mailbox. They will also check whether the same text was sent to other finance team members, which is the common pattern in October 2026.

The October 2026 variants worth knowing

The first variant is the PDF attachment. It lands as a .pdf or, more often, as a .html file that opens in a browser. The .html is a fake portal that looks like a Microsoft sign-in page but is hosted on a domain that has nothing to do with Microsoft. The .pdf is a static image with a link printed at the bottom. Either way, the goal is to harvest the Microsoft 365 password and any payment information you are willing to type.

The second variant is the link shortener. The text does not carry an attachment. It carries a t.co, a bit.ly, a tinyurl, or a custom short domain. The short link masks the destination, which is normally a lookalike page on a domain that was registered in the last 30 days. This variant is harder to spot before you click, which is why the only safe answer is to log in to Microsoft 365 directly and check billing there.

The third variant is the callback. The text asks you to call a number, usually a US 1-800 or a UK 0800 prefix. The number rings to a call centre where a polite person, often with a clear American or British accent, will tell you the invoice is real and walk you through "fixing" the billing record. The fix is to read out a one-time code the caller will say Microsoft sent you. That code is a password reset, an MFA challenge, or a sign-in to a new device. Once the caller has it, they own the account.

The fourth variant is the refund. Instead of asking you to pay, the text says you have been overcharged and offers a refund link. The link goes to the same kind of fake portal, but the form asks for card details so the "refund" can be processed. The refund is, of course, a charge. This is the variant aimed at individual Microsoft 365 Family and Personal subscribers, who do not have a finance team to slow them down.

The fifth variant is the calendar invite. A short text asks you to accept a calendar invite for a "Microsoft billing review". The invite carries an ICS file that, when opened, adds a recurring calendar entry with the phishing link in the description. The calendar entry is the clever part: it pops up on the screen at the time of the fake review, which is when the victim is busiest and least likely to think about where the entry came from.

The tells, in order

The first tell is the SMS itself. Microsoft does not send invoice notifications by SMS. It sends email, and it sends them to the billing contact on the tenant, not to a phone number the company does not otherwise know. If a text claims to be from Microsoft 365 billing and you have never received a Microsoft 365 text before, that is the tell.

The second tell is the link. Open the text on a desktop and hover the link, or long-press on a phone to copy the link and paste it into a notepad. Microsoft 365 invoice links go to microsoft.com, office.com, or akamised subdomains of those. They do not go to a freshly registered .shop, .top, or country-code domain, and they do not go through a shortener. If the link is anything else, the text is a scam.

The third tell is the wording. Real Microsoft 365 invoices reference a specific invoice number, a billing period, a tenant ID, and a payment method already on file. Scam invoices use vague language: "your invoice", "a billing issue", "a reattach error". The vagueness is on purpose. It is the cheapest way to make the text fit any business the scammer does not know.

The fourth tell is urgency. The text will say the invoice is overdue, the account is about to be suspended, or the refund will expire in 24 hours. The urgency is the engine. Microsoft does not suspend Office 365 in 24 hours. It sends multiple emails over weeks before any service change.

The fifth tell is the support number. Real Microsoft support is reachable through the admin centre, not through a number printed in a PDF. Any number in a text, a PDF, or a fake portal is part of the scam. Call it and you are talking to the people who sent the text.

How to make sure you never pay the next one

Set a rule in finance that any vendor change, including a change of bank details, must be confirmed by a known phone number. The number is the one you have on file, not a number in the invoice. A text or email is a delivery mechanism, never a verification mechanism. The same rule should apply to any request to open a portal, read out a one-time code, or install a tool like AnyDesk or Quick Assist. None of those are part of a real Microsoft billing flow.

Turn on the Microsoft 365 unified audit log and review it weekly. The audit log will show any new sign-in, any new OAuth grant, and any new inbox rule. A finance mailbox that suddenly has a forwarding rule to an external address is the most common sign a tenant has been compromised through one of these texts. Catch the rule and you catch the loss.

Move invoice approval to a second channel. The person who opens the invoice should not be the person who releases the payment. The second person is the friction the scam is trying to remove. Two-person approval is the single most effective control against business email compromise, and it works just as well against the SMS variant.

Finally, report every text to 7726 and to the FTC at reportfraud.ftc.gov. The carriers use 7726 reports to refine spam filters. The FTC uses the database to bring cases. The cost of reporting is two minutes. The cost of paying a fake invoice is the invoice.

This is general safety information, not legal advice. Scams change. If you need an official desk: FTC ReportFraud or IC3.