Australian banks warned on Friday that scammers would use the global Microsoft 365 outage as cover, as Microsoft said it had found the process behind the failure but gave no estimate for when services would be fully restored.
ING told customers to be on alert for fraudsters seeking to take advantage of the disruption. "Scammers may contact you offering to resolve the Microsoft or other systems issues," the bank said, according to ABC News. "Do not allow anyone access to your devices without confirming with the organisation through their publicly listed contact number."
The Customer Owned Banking Association issued a similar alert. Martin Latimer, COBA's head of financial crimes and cyber resilience, said scammers often switch to phone calls when email is down, and warned that criminals may keep posing as technical support after Microsoft's systems return to normal. His advice to anyone unsure about a caller was to hang up and ring them back on a number you know is genuine.
“Scammers love outages - they could impersonate service providers when people are anxious and looking for fixes,” Dr Arachchilage a cybersecurity expert from RMIT University told news.com.au.
In its latest update, Microsoft said a process on the affected servers that establishes secure connections was becoming overwhelmed, causing the servers to stop processing requests. It said it was preparing a configuration change for all affected servers and testing it on a subset first.
Microsoft also said it had begun reverting a recent network configuration change that coincided with the start of the outage. That is a shift from an earlier update, in which the company said it had not found any recent change that matched the timing. Temporary limits on traffic are in place in some locations while Microsoft checks whether servers stay stable.
The company has said there is "no indication this is a cyber attack," but speculation has been rife as the company has tried and failed to repair the fault.
“They are pointing to the health check component, so that reads as a failure to upgrade a piece of equipment,” said Dr Arachchilage, although he also speculated that even a disgruntled employee could be behind the fault.
Read next: Australian firms face growing outage losses their insurance may not cover
Outages make social engineering easier. Staff who can't email their IT provider are more likely to accept a call from someone claiming to be from Microsoft. Businesses and clients using temporary phone numbers and personal email addresses are more likely to believe a message that says contact or bank details have changed.
Those are the losses where cyber policies are often thinnest. Social engineering and funds transfer fraud sublimits often sit well below headline cyber policy limits, and many Australian policies exclude business email compromise or invoice fraud losses where no system was compromised, with social engineering cover often available only as an optional add-on, according to IB's review of current wordings. A client tricked into giving a fake technician remote access, or into paying a redirected invoice, may find the loss falls into exactly that gap.
The scale of the problem is large. Australians reported combined scam losses of $2.18 billion in 2025, up 7.8% on the year before, according to the National Anti-Scam Centre. AFCA is also preparing for expanded scam powers under the Scams Prevention Framework.
Read next: AFCA's expanded scam powers raise new questions for insurance brokers
Richard Buckland, professor of cybercrime and cyber war at UNSW, told the ABC that organisations still hadn't put workarounds in place since the CrowdStrike outage in July 2024. "We're still seeing that people don't have workarounds, so somehow we're not learning the lesson," he said.
He suggested fallbacks such as open-source email alternatives, internal mail servers, chat groups or Signal channels, and said many organisations now keep printed phone lists of key staff. "Everyone needs a Plan B and it can't be hypothetical. It must be rehearsed and tested," he said.
A tested Plan B also helps against scams. If staff and clients know in advance which channels are genuine during an outage, a caller claiming to be from Microsoft or a message announcing new contact details is easier to spot.
Read next: Cyber costs surge as Australian businesses lag on crisis readiness
Brokers can tell clients to treat any unsolicited call from "Microsoft", an IT provider or a bank's "tech team" as suspect for at least the next week, and to confirm through a number they already have before giving anyone access to a device. Clients should also confirm any change to payment or contact details by phone before acting on it.
At renewal, the outage gives brokers a practical reason to check three things: the social engineering and funds transfer fraud sublimits in each client's cyber policy, whether that cover requires a system compromise to respond, and whether the client has an outage plan that staff have practised.
Read next: Scam losses are up – but the real story is in the policy wording
Suspected scams can be reported to Scamwatch at scamwatch.gov.au.
