Why recovery can be just as risky as the outage

As Microsoft 365 services come back online, businesses face a quieter but more serious threat: the rush to catch up.

When a global outage hits, attention naturally falls on the moment things break. Emails stop, meetings fail and teams scramble for workarounds. But this week’s Microsoft 365 disruption is a reminder that the most dangerous period often comes later, when services return and everyone tries to make up for lost time.

Why recovery is the risk window

When email flow resumes after a long outage, messages don’t arrive neatly. Hours of delayed mail can land at once, often out of order, with replies appearing before the messages they answer. Inboxes fill, ticket queues swell and phones ring. Every team is under pressure to clear the backlog quickly.

That is exactly the environment fraudsters look for. A high-profile outage gives them a near-perfect set of conditions:

• Cover. A fake message is far easier to miss among hundreds of genuine, delayed ones
• A believable story. Everyone expects messages about Microsoft this week, so “re-verify your account” or “reconnect Outlook” won’t raise eyebrows
• Pressure. Staff are busy and want to clear the backlog quickly. Urgency is the scammer’s most powerful tool
• Broken routines. When Teams or email is unreliable, the usual quick check with a colleague doesn’t happen, and people are more likely to act alone
• Confusion. Out-of-order emails make it hard to tell what’s genuine, so a fake “reply” in a real conversation can slip straight through.

None of this is unique to Microsoft. It’s a technology-agnostic moment that could follow any major disruption, whether a cloud outage, a ransomware attack, a power cut or a supplier failure.

“There are sharks out there looking for opportunities, and that opportunity is chaos,” says Lee Doughty, Director of Security, Resilience and AI Practice at Intercity.

“Whenever the focus is on restoring normality that is the ideal time for predatory activity. That’s why it’s OK to take your time, and to tell your teams the same.”

The risk isn’t just technical. It’s human: tired, busy people making quick decisions.

The scams to watch for

The tactics aren’t new, but they are getting harder to spot.

• Phishing is the most familiar: an email pretending to come from someone you trust, such as Microsoft, IT, a supplier or a customer, designed to get you to click a link, open an attachment, hand over a password or approve a payment. After an outage, expect fake password resets, “service restored” notices and invoices dressed up as delayed messages.
• Vishing, or voice phishing, moves the same trick to the phone. A caller claiming to be IT support or Microsoft offers to help “restore access” and asks for login details, an authentication code or remote access to a device. With email unreliable, people are more likely to trust a phone call.
• Smishing does it by text message: a short, urgent SMS with a link to “fix your account” or confirm details. On a mobile screen, fake links and sender names are much harder to check.
• AI-powered scams are raising the stakes. Generative AI means phishing emails no longer give themselves away with poor spelling or awkward phrasing. Criminals can write fluent, personalised messages at scale, clone a senior leader’s voice from a few seconds of audio, or produce convincing fake video. A call that sounds exactly like your finance director asking for an urgent transfer is no longer science fiction.

The common thread is that each one exploits trust and urgency. That’s why the right response is not more technology, but a pause.

Three things leaders should do now

1. Give people permission to slow down. Being rushed is when mistakes happen. Leaders should say explicitly that accuracy matters more than speed this week. Five minutes checking an email is better than five days in incident response.
2. Communicate what you know, and only what you know. Customers and partners don’t need promises about when everything will be fixed. They need honest, regular updates. Use the phone where email is unreliable, keep local records of decisions and impact, and resist the urge to overpromise on timelines you don’t control.
3. Verify everything. Treat any unexpected request for a payment, a change of bank details or login credentials as suspicious until confirmed through a trusted contact. Be wary of anyone claiming to be Microsoft or offering a “fix” for the outage. There isn’t one to download or buy.

Resilience is a mindset, not just a system

Outages like this are a test of how organisations behave under pressure, not just of their technology. The businesses that come through well will be the ones that keep talking to their customers, stay honest about what they don’t yet know, and refuse to let urgency override caution.

“Saying sorry to a customer for a late reply is far better than saying sorry for a data breach,” says James Pearse, CTO Intercity. “The next 24 hours are when vigilance matters most. Take your time, check everything, and keep talking.”