Microsoft’s Outlook Meltdown Is Over. The Fake ‘Restore Your Emails’ Scam Is Just Getting Started

If your Outlook spent Thursday and Friday acting like a teenager who won’t answer texts, you weren’t alone. Microsoft’s giant email and work-app outage is finally over. Microsoft said Saturday that it had “restored service to the remaining impacted customers and regions,” the Associated Press reported, after more than a day of broken inboxes, missing meetings and a whole lot of people refreshing the same screen.

Now for the bad news. The scammers didn’t take the day off. Microsoft’s own security team says crooks are already sending fake “outage” emails that claim some of your messages were held during the disruption and will be deleted in 24 hours unless you click a button to restore them. That button doesn’t restore anything. It’s built to steal your password. Here’s what happened, what the fake emails look like, and the five-minute plan to stay safe.

What actually broke

The trouble started around 17:25 UTC on Thursday, November 12, which is about 11:25 a.m. Central, according to network testing company Ookla, as DW reported. Outlook was the headliner, but Teams, Copilot and other Microsoft 365 apps were dragged in too. AP reported that the outage tracker Downdetector got reports from users in more than 70 countries and territories, and that governments, courts and businesses were hit.

To put the size in perspective, Microsoft said in January that it has more than 450 million paid commercial subscriptions to its 365 services, according to AP. That doesn’t count everyone with a free personal Outlook account. So yes, a lot of people discovered all at once how much of their life runs through one blue envelope icon.

Was it a hack? No. Microsoft told The Verge it “was a technical issue not related to cyber or AI / agents,” caused by “an issue during an earlier network capacity upgrade that surfaced following a recent network change.” In plain English, an upgrade meant to make things faster ended up knocking servers offline, and the rest of the system buckled under the extra load. It’s the tech version of trying to widen a highway during rush hour.

Your missing emails may still show up

Here’s a detail worth knowing before you panic about a lost message. During the recovery, Microsoft stretched its email timeout window to 48 hours so delayed messages wouldn’t be thrown away, PCQuest reported. That means some emails sent Thursday or Friday may arrive late, or land in your inbox out of order, tucked between newer messages.

So if you were waiting on a bill confirmation, a doctor’s appointment reminder, a job reply or a package notice, scroll back and look again. And if you sent something important during the outage, it’s worth a quick follow-up to make sure it got there. The same goes for calendar invites, since meeting scheduling was one of the things that broke. Microsoft has also promised a preliminary report on what went wrong within two business days and a final one within five.

The scam: fake “restore your messages” emails

This is the part that matters most. Microsoft Threat Intelligence warned that it spotted an active phishing campaign on November 13, while inboxes were still catching up, iTnews and NDTV Profit reported. Here’s what those fake emails look like:

• The subject line is the word “Outage” followed by a dash and a random six-character code.
• The sender name looks official, often your company’s name followed by “Outage Notification” or “Service Health.”
• It claims some of your messages were held during the outage and will be deleted within 24 hours unless you click to restore them.
• It quotes a real incident number, EX1550543, which is the genuine ID Microsoft gave this outage. Crooks copied it to make the email look legit.
• A “Restore Messages” button sends you to a page that isn’t Microsoft’s and asks you to sign in.

Microsoft said the emails hit organizations across multiple U.S. industries and that the activity is “consistent with credential phishing,” though it hasn’t confirmed whether any passwords were actually stolen. In other words, it’s a fake sign-in page wearing a Microsoft costume.

It’s not just email

Security firm Field Effect says outage-themed lures started showing up within hours, and they come in several flavors: fake Outlook password reset emails and text messages, notices claiming your “inactive” account is about to be shut off, and fake IT support phone calls offering to “fix” your account. IT company Techcare also flagged emails asking people to send payments to new bank details, blaming the outage for the change, and fake offers of refunds or compensation for the downtime.

That phone angle is sneaky. When email is down, people expect a call instead, and scammers know it. Australia’s IMB Bank warned that crooks often pivot to phone calls during an email outage, and pointed out that Microsoft won’t contact you out of the blue asking for remote access to your computer or your payment details to fix an outage. If a caller says they’re from Microsoft and wants to “just connect to your PC for a second,” hang up. That’s not tech support. That’s a home invasion with better manners.

Your five-minute safety plan

• Don’t click “restore” links. Microsoft doesn’t send emails asking you to rescue held messages before a deadline. If you’re worried something is missing, open Outlook the way you normally do and search for it.
• Check status the safe way. If you want to know whether Microsoft is having problems, go to Microsoft’s official status page or status account by typing the address or searching yourself, never through a link in an email or text.
• Treat deadlines as a red flag. “Act within 24 hours” is a pressure trick. Real companies rarely threaten to delete your stuff by tomorrow.
• Never give out a sign-in code. No real support person needs your password or the six-digit code sent to your phone. Not Microsoft, not your bank, not your IT department.
• Verify money changes by phone. If anyone emails new bank details for a payment, call them at a number you already have, not one in the email.
• If you already clicked and typed your password, change your Microsoft password right away from the official site, sign out of other devices, and turn on two-step verification. If it’s a work account, tell your IT team now, not Monday.

At work, there’s one more quick tell. Techcare notes that real Microsoft quarantine notices come from quarantine@messaging.microsoft.com with the subject “Microsoft 365 security: You have messages in quarantine,” and they don’t mention outages or 24-hour deadlines. If yours looks different, forward it to your IT folks instead of clicking.

Why it matters to you

Big outages make us jumpy, and jumpy people click things. That’s exactly why scammers love a crisis. A fake email that shows up while you’re already worried about missing messages feels helpful instead of suspicious, especially when it quotes a real incident number you might have seen in the news.

The good news is that the defense is simple and it works for every scam, not just this one: slow down, don’t use links in surprise messages, and go straight to the app or website you already know. And if you take one bigger step this weekend, make it adding a stronger lock to your main email account. Your email is the master key to everything else, since nearly every password reset for your bank, shopping and social accounts lands there.

What I’d grab

A password can be tricked out of you. A physical key in your pocket can’t. If you want your email to stay yours even after a bad click, these are the two I’d look at:

• Yubico YubiKey 5 NFC: a physical sign-in key for your Microsoft account and other big accounts. Even if a fake page tricks you into typing your password, the crook can’t get in without this key in your hand.
• Yubico Security Key C NFC: the simpler, cheaper version with a USB-C plug for newer laptops and phones. It handles passkeys and two-step sign-in, which is the job most people need.

As an Amazon Associate I earn from qualifying purchases.

The bottom line

Microsoft’s outage was a glitch, not a hack, and it’s fixed. The real danger now is the wave of fake “outage” emails, texts and calls trying to cash in on the confusion. Ignore any message that wants you to restore, verify or reset something in a hurry, check things through the app you already use, and guard your sign-in codes like the keys to your house. Because they are.

Got a weird “outage” email or call you’re not sure about? Tell me about it through the Contact Us page, and I’ll help you sort the real from the fake.

Like your tech news short and sweet? Catch my quick daily videos on YouTube.

Sources

• Associated Press: Microsoft says services fully restored after hourslong global outage (Nov. 14, 2026)
• Associated Press: Microsoft outage shows the risks of relying on a single technology provider (Nov. 13, 2026)
• The Verge: Microsoft’s massive Outlook outage might be over (Nov. 13, 2026)
• DW: Microsoft says all services working again (Nov. 14, 2026)
• iTnews: Phishers quick to exploit extended M365 outage (Nov. 2026)
• NDTV Profit: Microsoft 365 users targeted by fake outage notifications in phishing campaign (Nov. 14, 2026)
• Field Effect: Microsoft 365 outage theme drives credential phishing and support scams (Nov. 2026)
• Techcare: Microsoft 365 outage phishing emails, what to look for (Nov. 2026)
• PCQuest: Microsoft 365 is back online but Outlook emails are still playing catch-up (Nov. 14, 2026)
• IMB Bank: Scam alert, scammers likely to exploit Microsoft outage to target consumers (Nov. 13, 2026)

Top photo: Microsoft sign, Wikimedia Commons, public domain.