Business SaaS 'License Expired' Phish
An email says your business software license (Microsoft 365, Adobe, etc.) expired and links to a fake portal that steals your work login and payment details.
Think a message like this reached you? You can check it right now.
What this scam is
Employees receive a message that a business software license or subscription has expired or must be re-verified to avoid losing access, with a link to 'renew' or 'reactivate.' The portal is a phishing page that captures corporate credentials (often the keys to email and files) and card/billing details. Because losing access to work tools is disruptive, people act fast. Real license management happens in the vendor's admin console.
What it usually looks like
- A 'license/subscription expired' email for work software.
- A link to renew or reactivate.
- A fake login/billing portal.
- Urgency about losing access.
Common warning signs
- Renewal links to non-official domains.
- Requests for your work login and payment info.
- Pressure about immediate loss of access.
- Generic sender or odd address.
Example wording scammers use
“Your Microsoft 365 license has expired. Reactivate within 24 hours to keep access: m365-license-renew.net”
“Adobe subscription payment failed — sign in to update billing and avoid interruption.”
These are illustrative examples written by ScamSplain, not real messages.
What the scammers want
- Corporate login credentials.
- Card/billing details.
- Access to company email and files.
What to do
- Check licenses in the vendor's official admin console, not via the email.
- Report suspicious emails to your IT/security team.
- Never enter work credentials on a link.
- Use single sign-on and MFA.
What to do if you already responded
- Notify IT immediately; change the password and revoke sessions.
- Have finance watch for fraudulent charges.
- Report internally and at reportfraud.ftc.gov.