HMRC Alerts Customers to Microsoft Impersonation Scams After Day-Long Outage

HMRC has warned customers about scam calls impersonating Microsoft and asking for HMRC usernames and passwords, after a day-long global Microsoft outage on November 13. The Express.co.uk reported the alert, in which the department urged people to "stop and think" before sharing personal information. HMRC said it had received reports of the fraudulent calls following the outage.

HMRC's Warning on Fake Microsoft Calls

In a post on X, HMRC said: "We've had reports of customers receiving scam calls claiming to be from Microsoft, asking for HMRC usernames and passwords. Microsoft or HMRC will never ask you to provide personal information or sign in details on a phone call, text or email." The department told customers to stop and think if a request is genuine before sharing personal information, and to report anything suspicious if unsure.

HMRC pointed customers to an online checklist for spotting scams. The department said a contact may be a scam if it rushes you, is threatening, is unexpected, asks for personal information such as bank details, tells you to transfer money, or offers a refund, tax rebate or grant. HMRC added that it will never leave a voicemail threatening legal action or arrest, never use social media to offer a tax rebate, and never ask for payment with gift or payment vouchers.

HMRC also said it does send text messages to some customers, which may include a link to GOV.UK information or to HMRC webchat. It advised customers not to open links or reply to a text message claiming to be from HMRC that offers a tax refund in exchange for personal or financial details.

Microsoft confirmed the outage was caused by a technical configuration error stemming from a network capacity upgrade, and ruled out a cybersecurity breach or issues related to its AI systems. The disruption stopped access to Outlook, Microsoft Teams, OneDrive and Copilot across more than 70 countries, and affected corporate networks and government agencies. In the UK, NHS staff were forced to pivot to paper-based records, and there was also disruption in the US House of Representatives.

Other Breach Disclosures This Week

Honda Motor suspended its Giftpad services after a third-party data breach exposed 1,741 individual shareholders' email addresses, The future of trading reported on November 13. Brazil's Tesouro Nacional reported a security incident on November 4 that exposed personal data of about 30,000 registrations and 4,000 Pix keys, Folha reported on November 12. Chainstack said an AI-powered breach in late October exposed customer names, emails and password hashes, with the threat contained by October 31, TradingView reported on November 12.

Microsoft's Recovery Statement

Microsoft said on Friday that its consumer products services had fully recovered, while it was seeing some sustained recovery for its Microsoft 365 enterprise services, Devdiscourse reported. The company did not disclose specific details about the recovery or any affected services.