Microsoft Teams used for high-value romance scams in China

What changed

Microsoft Teams has become a primary channel for high-value romance scams in China. In May 2026, a woman in Beijing lost more than $100,000 to a fraudster posing as a Microsoft researcher. The scam began on Xiaohongshu, a social media platform, before the perpetrator moved the conversation to Teams, where he provided the victim with a new account and password to use.

Why it matters

The shift from open social media to a corporate productivity tool changes the attack surface for fraud networks. Teams is not designed for casual dating or unverified personal chats. When scammers migrate conversations there, they bypass the social context users expect from platforms like Xiaohongshu. The provision of a dedicated Teams account and password signals a structured operation rather than a random interaction. This creates a specific trust gap. Users may associate the Microsoft brand with corporate security and stability. That association makes the platform a convincing stage for a fraudster claiming to work for a major tech company.

The immediate consequence is financial loss for victims, but the longer-term risk is reputational damage to the platform in the Chinese market. If Teams is perceived as a safe harbor for scams, it undermines the trust that enterprise customers and regulators place in its security posture. This is a social engineering problem, not a technical breach. The attackers are exploiting human trust in the interface, not hacking the code. This distinction matters because it means standard technical firewalls will not stop these attacks. The solution requires behavioral detection and user education.

If Microsoft does not implement enhanced fraud detection for these specific patterns, the problem will likely persist. Scammers may also migrate to other less-regulated platforms if Teams becomes too difficult to use for their operations. This would leave victims without protection and potentially force Chinese regulators to impose stricter cross-border data and fraud prevention standards on foreign platforms.

What to watch next

Watch for security blog posts from Microsoft addressing specific fraud vectors on Teams in China. This could include new warnings or friction in account creation processes. Also monitor for statements from Chinese regulators regarding the accountability of foreign platforms for user protection. Any official warnings or fines would indicate that regulatory pressure is mounting. These signals will clarify whether Microsoft is adapting its security measures to address this specific threat or if the problem is shifting elsewhere.