Scam victims in China are logging into Teams accounts their scammers control

Provisioning is the part of this that a product team can act on. When one person creates an account and hands the login to someone else, the second person occupies the account rather than owning it. The recovery path stays with the creator, which means the linked email or phone stays there too, and so does the power to reset the password. Zhao's scammer met her on Xiaohongshu, moved the conversation to Teams, and offered her an account and password to use ^[2]. She told WIRED she took it because she had used the app before and it was made by Microsoft ^[3].

An invited-user flow is supposed to mean an employee whose employer already vetted them, joining a tenant, with an IT desk to walk to. In practice, some users sign in with credentials from a stranger they met on a social app, then let the entire record of a financial relationship accumulate inside an account they cannot recover. Zhao took loans from several banks to put more money into the crypto project he pitched her ^[4].

The review data is worth doing the arithmetic on. Thirty percent of the 500 Teams reviews WIRED sampled works out to 150 posts complaining about scammers ^[10][16]. On Webex, 71 percent of more than 150 reviews since February 2025 is at least 106 posts ^[14][17], a rate roughly 2.4 times the Teams figure ^[18]. Those percentages are not fraud rates. App store reviews count the people angry enough to type, which makes them a floor on incidence and a weak basis for ranking platforms of different sizes. What they do establish is duration and spread: the oldest scam complaint on Teams dates to 2022 ^[10], some Chinese police bureaus have named the app in public warnings, one of them calling it a fraud-related app ^[8], and Maimai told Chinese media last year that it warns its own users when a message contains words like "Teams" or "Skype" ^[9].

The remedies address the two ends and not the middle. The June banner arrives in front of someone who already believes their counterpart is a Microsoft researcher, and retiring the consumer tier means an account now costs a tenant ^[13]. That is real friction, though the underlying design still works against victims: "your organisation issued this login and can take it away" is exactly what enterprise identity is built to do, so the handover the scammers rely on looks like ordinary administration. Steven Masada, who runs Microsoft's digital crimes division, told WIRED the company investigates abuse reports and takes action against accounts that break its policies ^[12]. Of the dozens of victims who contacted Zhao, one reported recovering any money, and did it by tracking down the recipient's bank account rather than through anything a platform did ^[6].

For anyone shipping an invite or provisioning flow, draw two axes: who created the account, and who holds recovery. Self-created plus self-recovery is the consumer case. Third-party-created plus third-party-recovery is corporate IT, and it is also the quadrant this scam sits in, which is why keyword filters and banners are doing the detection work instead of the identity system. In that quadrant, the open question is narrower: can a user export their own message history without the creator's cooperation, and can the platform's logs tell an account minted by a paying admin apart from one minted by a signup from last week. Zhao's case and the review claiming RMB 1.48 million in losses ^[11] both turn on evidence the victim could not retrieve.</body_markdown> </invoke>