How Scammers Are Weaponizing Microsoft Teams, Webex and Other Legitimate Western Enterprise Tools to Defraud Thousands in China

A 30-something Beijing resident, identified only by her surname Zhao for privacy, lost more than $100,000 in May this year at the hands of a romance scammer who posed as a Microsoft researcher. The fraudster first struck up a conversation with her on Chinese lifestyle social platform Xiaohongshu, before steering her off the app to continue their chats on Microsoft Teams — and even offered her a pre-made account and password to log in directly.

“I didn’t think twice about it, since I’d used Teams before, and it’s a Microsoft product I already trusted,” Zhao recalls. Once they moved to the new platform, the scammer began painting a picture of a shared long-term future together, before pitching her a cryptocurrency investment scheme he claimed generated far faster returns than stock trading. Eager to seize what she saw as a life-changing opportunity, Zhao took out multiple bank loans to pour more money into the project — until the scammer vanished completely with all her funds. Worse, the custom Teams account the fraudster had given her was deactivated, so she could no longer access their chat history to submit evidence to police.

After Zhao shared her story on social media, she connected with dozens of other people across China who had fallen for the exact same scam pattern. Their reported losses ranged from $1,500 to a staggering $300,000, and only one victim managed to recover a portion of their funds by tracking down the recipient’s bank account. Every single person in the group described an identical step in the fraud flow: scammers instructed them to download Microsoft Teams, and log in using pre-shared credentials created by the fraud ring.

The tactic has become so pervasive that multiple local Chinese law enforcement bureaus have released explicit public warnings naming Teams as a common scammer tool, with one local police department even labeling it a “fraud-associated app”. Maimai, China’s professional social platform comparable to LinkedIn, announced last year that it automatically triggers anti-scam pop-up warnings for users when high-risk terms including “Teams” and “Skype” are detected in private messages. For years, angry scam victims have flooded Teams’ Chinese Apple App Store page with negative reviews to warn other users: a WIRED analysis of 500 Teams reviews from the past 18 months found that 30% of them contained explicit references to fraud, with the earliest scam complaint dating all the way back to 2022. One January 2024 review reads: “Scammers got me to register this app to talk to them, and defrauded me of 1.48 million RMB ($220,000). Police have opened a formal case. This was a classic ‘pig-butchering’ romance scam — this was a bitter, expensive lesson, don’t let anyone else fall for it.”

---

Platform Responses to the Exploitation

Microsoft has pushed back that scammers routinely leverage well-known trusted brands and mainstream communication platforms to run social engineering schemes. “We investigate all reports of platform abuse, take action against accounts that violate our terms of service, and continue to upgrade protections to spot and disrupt fraudulent activity,” Steven Masada, global head of Microsoft’s digital crimes division, told WIRED in a statement.

Since June this year, the company has rolled out a prominent public warning banner for all Teams users in China, cautioning them against common scam patterns and reminding users to exercise extreme caution when sharing sensitive personal information. Microsoft has also fully discontinued the personal consumer version of Teams in China, so the service is now only accessible to users with official enterprise accounts registered to legitimate organizations.

The pattern of scammers abusing Western enterprise communication tools extends far beyond Teams. Users on Chinese social media have reported nearly identical scam flows targeting people on Cisco-owned video conferencing platform Webex, and Cliq, a workplace messaging app owned by Indian tech giant Zoho. A WIRED analysis of Webex reviews on the Chinese Apple App Store found that 71% of more than 150 reviews posted after February 2025 reference losing money to scammers on the platform. Cisco did not respond to requests for comment.

Sam Wunderl, a spokesperson for Zoho, noted that the company has identified “a small number of isolated cases where scammers used Zoho Cliq to defraud victims”, which the firm detected through internal suspicious activity monitoring. As of August 27, Zoho has disabled all in-app online payments for Cliq users in China, suspended every account traced to confirmed suspected scammers, and announced plans to fully phase out the free version of Cliq for the Chinese market going forward.

---

The Scammer Playbook

Dozens of victim accounts shared across Chinese platforms including Xiaohongshu and Douyin show that fraud rings cast an extremely wide net to find targets. They pose as corporate recruiters reaching out about open roles, prospective renters messaging private landlords, dating app matches on Tinder, and even international business buyers looking to source products directly from Chinese factories.

The scammers lean heavily on Teams’ enterprise management features: they create custom accounts for every target, and send over pre-generated login details. Because the fraud ring fully controls the entire organization the accounts are tied to, they can deactivate each victim’s account the second the scheme is complete, permanently erasing chat histories that could be used as evidence for law enforcement. To justify why they are not using ubiquitous local messaging apps like WeChat, scammers often tell targets they are using a company-issued work device restricted to approved enterprise tools, or claim the custom Teams space is a “private secret chat base” exclusively for the two of them to avoid being monitored by colleagues.

When Zhao later reconnected with the same scammer that defrauded her, pretending to be a new potential victim, he told her the Teams account she was given “is for team members to contact family while on a confidential work project”. When she asked what the specific username “joy20706905” meant, the scammer claimed “the software assigns it automatically when you buy an account from Microsoft”. At the time she was scammed in May, Teams had no anti-scam warnings active to flag her high-risk conversation — the public warning banner only appeared on her account when she messaged the scammer again in August.

---

Why These Enterprise Tools Are So Popular With Fraudsters

Teams and similar Western enterprise platforms are almost perfectly optimized for scammers operating in China. Unlike unregulated international chat apps Telegram or WhatsApp, they are not blocked by Chinese internet restrictions, so they are easily accessible to ordinary users. They also include built-in features like screen sharing and remote device control that scammers can abuse to take over victims’ phones or computers. Most critically, they are widely perceived as legitimate, low-risk tools built by trusted global tech brands, making targets far less suspicious of unusual requests.

That exact dynamic nearly cost Chinese software engineer Tan Chenxin, who lives in New York, his savings earlier this week. He received a call from people claiming to be part of a joint cross-border investigation run by US Customs and Border Protection and Chinese law enforcement, who instructed him to download Webex to join a secured video call to discuss a supposed legal issue. “I looked up Webex and saw it was developed by Cisco, a leading global cybersecurity vendor, and I already knew the Cisco brand, so I convinced myself it was safe,” he says. He only realized he was caught in a scam right before he was about to transfer funds, and hung up. Tan adds that he could not find any easy, obvious way to report the scammer’s account directly to Webex.

Compared to local Chinese messaging platforms that have spent years building defenses against rampant investment and romance fraud, these Western enterprise tools appear far less prepared to counter the threat. Apps including WeChat and Xiaohongshu now routinely flag scam risks to users automatically when they detect keywords tied to investments, payments or suspicious out-of-platform chat requests, even in fully private one-on-one conversations. Even WIRED’s own private chats with scam victims on Xiaohongshu triggered repeated anti-fraud warnings as victims recounted their fraud experiences.

This piece is adapted from the Made in China newsletter written by Zeyi Yang and Louise Matsakis.