A Fresno professional-services desk forwarded us an urgent “Office sync error — recover your messages” note. The logo looked right. The tone sounded official. The sender domain was not Microsoft’s.

That is the campaign we keep seeing across Central California: Valley offices and coast practices getting the same pattern in different wrappers. Urgency first. Recovery second. A link that asks you to “fix” sign-in.

What the message is trying to do

The goal is not to fix sync. It is to get a password, an MFA approval, or a session token. Once that lands, the attacker can read mail, create rules, or poke at vendor portals from a mailbox that looks like yours.

Your staff should not be graded on whether they catch every fake. People click good fakes. Good IT makes that click expensive and gives the office a clean way to report it.

A simple check before anyone clicks

When something looks like Microsoft, run a short Sender–Links–Attachments–Message pass:

  • Sender: hover the address. Does the domain actually belong to Microsoft, or is it a lookalike?
  • Links: where do they really go? If the path is not a known Microsoft login host, stop.
  • Attachments: unexpected files asking you to “enable” or “recover” are a hard no.
  • Message: fake urgency, or a recovery claim you did not request.

Then report it in Outlook the way your provider taught you — do not forward the live link around the office as a screenshot substitute if reporting is available.

What should already be in place

Filtering and safe-link controls belong on the Microsoft 365 tenant before the message reaches the bookkeeper. Reporting has to land somewhere a human actually reads. Awareness training only helps when it matches this year’s tricks, not a 2018 slideshow.

We walked that Fresno team through not clicking, reporting the message, and confirming nothing was entered. Same playbook applies in Clovis, Madera, and coast offices when the brand on the email is not the brand that sent it.

What we do

We keep Microsoft 365 phishing controls tuned, make sure user reports reach someone who reviews them, and walk offices through Sender–Links–Attachments–Message checks when a fake sync or recovery email shows up.

If your team is still deciding alone whether a “Microsoft sync error” is real, reach out. We will tell you what is already in front of your inboxes — and what is not.