Scammers in China are increasingly exploiting enterprise communication platforms like Microsoft Teams, Cisco Webex, and Zoho Cliq to defraud victims, prompting warnings from law enforcement and affected companies. The schemes, often "pig-butchering" romance or investment scams, have led to reported losses ranging from $1,500 to $300,000.
Victims frequently report being instructed to download Microsoft Teams and log in using credentials provided by the scammers. This tactic is so prevalent that some Chinese law enforcement agencies have explicitly identified Teams as a "fraud-related app." Analysis of reviews on Apple's Chinese app store revealed that 30 percent of 500 Teams reviews over the past 18 months contained scam complaints, with the earliest dating back to 2022. Similarly, 71 percent of over 150 Webex reviews since February 2025 referenced scam incidents.
One Beijing resident, Zhao, reported losing over $100,000 in May after a scammer, posing as a Microsoft researcher, moved their conversation from Xiaohongshu to Teams. The scammer provided her with a Teams account and password, then introduced her to a cryptocurrency investment project before disappearing with her funds. Zhao noted that she could no longer access the Teams account to retrieve chat logs for police. After sharing her experience online, she connected with dozens of other victims who described similar patterns, all involving logging into Teams with scammer-provided credentials.
Scammers leverage Teams' enterprise features by creating accounts for targets, controlling the "organization," and deactivating accounts post-scam, thereby erasing chat histories. They often explain the unusual setup by claiming they are using work devices with app restrictions or that they created a private Teams account for exclusive communication. When confronted about using Teams instead of popular Chinese messaging apps like WeChat, scammers have claimed their colleagues could monitor WeChat messages, portraying Teams as a "secret base."
Microsoft acknowledges that fraudsters exploit trusted brands and platforms for social engineering. The company stated it investigates abuse reports, acts against policy-violating accounts, and strengthens protections. In June, Microsoft began displaying a general warning banner to Teams users in China about common scams and the importance of cautious information sharing. The personal version of Teams has also been discontinued in China, making the service available only through enterprise accounts.
Zoho, the developer of Cliq, confirmed "a limited number of instances" of scammers using their platform. As of August 27, Zoho disabled online payments to Cliq in China, suspended identified scammer accounts, and plans to discontinue the free version of Cliq in the country. Cisco, the owner of Webex, did not comment on the reports.
Cybersecurity experts suggest that Teams and Webex are attractive to fraudsters in China because, unlike Telegram or WhatsApp, they are not blocked by the government. Their advanced features, such as screen sharing and remote control, also offer potential avenues for greater control over victims' devices. Crucially, their status as legitimate workplace communication tools from trusted multinational companies lends an air of authenticity that scammers exploit. Chinese platforms like Maimai, similar to LinkedIn, have implemented warnings for users when high-risk keywords like "Teams" and "Skype" are detected in messages.
