Microsoft Teams Becomes a Growing Tool for Scammers in China
A romance scam network in China has been using Microsoft Teams to gain victims' trust before stealing large sums of money, with some losses reaching hundreds of thousands of dollars. Microsoft has begun rolling out warnings, though the scheme persists.
A woman in Beijing, identified only by her surname Zhao, says she lost more than $100,000 in May to a scammer posing as a Microsoft researcher. After meeting on the Chinese social platform Xiaohongshu, he convinced her to move their conversation to Microsoft Teams, setting her up with a pre-made account and password. He later introduced her to a cryptocurrency investment scheme, encouraging her to take out bank loans to invest more, before disappearing with her money.
After Zhao shared her story online, dozens of other people in China came forward describing the same pattern, with losses ranging from $1,500 to $300,000. Several local Chinese law enforcement bureaus have since issued warnings explicitly naming Teams as a tool used by fraudsters.
Why scammers favor Teams
Unlike Telegram or WhatsApp, Teams is not blocked in China, and its features such as screen sharing and remote control give scammers greater access to victims' devices. Because scammers control the organizational accounts they create, they can deactivate them once a scheme concludes, erasing chat logs that could serve as evidence.
According to WIRED's analysis of 500 reviews of Teams posted over the past 18 months on China's Apple App Store, 30 percent explicitly described being scammed, with the earliest such review dating back to 2022.
Microsoft says it investigates abuse reports and continues strengthening its fraud protections. In June, the company began showing Teams users in China a warning banner about common scams and discontinued the personal version of the app in the country, leaving only enterprise accounts available. Similar scam patterns have also emerged on other corporate platforms, including Cisco's Webex and Zoho's Cliq, both of which have since introduced additional security measures.
