Western Business Apps Like Microsoft Teams Exploited in Widespread Chinese Romance and Investment Scams.

A troubling surge in sophisticated romance and investment scams is sweeping across China, with fraudsters increasingly leveraging seemingly legitimate Western business communication platforms such as Microsoft Teams, Cisco Webex, and Zoho Cliq to defraud unsuspecting victims of millions of dollars. These scams, often described as "pig-butchering" schemes, exploit the trusted brand names and enterprise functionalities of these applications, leading to devastating financial losses and a growing chorus of warnings from both victims and local authorities.

Zhao, a woman in her thirties residing in Beijing, recounts a harrowing experience in May when she lost over $100,000 to a romance scammer. The perpetrator, who falsely claimed to be a researcher working for Microsoft, initially engaged Zhao on Xiaohongshu, a popular Chinese social media platform. He swiftly suggested moving their conversation to Microsoft Teams, even providing her with a pre-configured account and password for convenience. "I didn’t think much because I had used this app before. And since it was developed by Microsoft, I kind of trusted it," Zhao explained, requesting anonymity for privacy reasons.

Once on Teams, the scammer escalated his deception, promising a shared future and introducing Zhao to a lucrative cryptocurrency investment project. He assured her it would yield profits far more rapidly than traditional stock trading. Enticed by the prospect of quick returns and a romantic future, Zhao invested heavily, even taking out loans from multiple banks to maximize her participation. However, the dream quickly turned into a nightmare when the scammer vanished, taking all her money with him. The pre-provided Teams account he had given her was subsequently deactivated, preventing her from accessing crucial chat logs that could serve as evidence for police.

Zhao’s story is far from isolated. After sharing her ordeal on social media, she was contacted by dozens of other individuals across China who had fallen prey to identical schemes. Their reported losses ranged from a minimum of $1,500 to a staggering $300,000. Of all the victims Zhao heard from, only one reported a partial recovery of funds, achieved through the arduous process of tracing the recipient’s bank account. The pattern described by these victims was strikingly consistent: they were invariably instructed to download Microsoft Teams and log in using credentials supplied by the scammers.

The pervasive nature of this tactic has prompted local law enforcement bureaus in China to issue explicit warnings, specifically naming Teams as a tool frequently employed by fraudsters. One public warning even went so far as to label it a "fraud-related app." Maimai, a Chinese professional networking platform akin to LinkedIn, acknowledged the problem last year, informing Chinese media that it would automatically issue warnings to users if it detected high-risk keywords like "Teams" and "Skype" in messages, advising them on how to avoid scams.

Reviews on Apple’s Chinese app store paint a stark picture of the growing crisis. A WIRED analysis of Teams reviews over the past 18 months revealed that 30 percent of 500 reviews explicitly complained about scammers, with the oldest such complaint dating back to 2022. One particularly chilling review from January of this year read: "The scammers had me register for this app so they could contact me, and they defrauded me of RMB 1.48 million [$220,000]. The police have opened a case. This was unquestionably a ‘pig-butchering’ scam. Beware of fraud—this was a bitter and costly lesson!" This highlights the significant financial and emotional toll these scams inflict on victims.

Microsoft, the developer of Teams, stated that scammers routinely exploit trusted brands and communication platforms for social engineering schemes. Steven Masada, the global head of Microsoft’s digital crimes division, confirmed that the company "investigates reports of abuse, takes action against accounts that violate our policies, and continues to strengthen protections designed to identify and disrupt fraudulent activity." In response to the escalating issue in China, Microsoft implemented a general warning banner for Teams users in the country in June, cautioning them about common scams and urging vigilance when sharing sensitive information. Furthermore, the company has discontinued the personal version of Teams in China, making the service accessible only through enterprise accounts.

The problem, however, extends beyond Microsoft Teams. Reports on Chinese social media platforms indicate variations of these scams involving other corporate software applications, including Webex, a video conferencing platform owned by Cisco, and Cliq, a workplace communication app developed by the Indian software giant Zoho. WIRED’s analysis of Webex reviews on Apple’s Chinese app store showed an alarming trend: since February 2025 (likely a typo, meant to be 2024), 71 percent of over 150 reviews referenced being scammed on the platform. Cisco did not respond to requests for comment regarding these incidents.

Zoho, the owner of Cliq, acknowledged "a limited number of instances involving scammers using Zoho Cliq to defraud victims." A spokesperson, Sam Wunderl, confirmed that the company uncovered this suspicious usage internally. In response, as of August 27, Zoho disabled online payments to Cliq in China, suspended every account created by the suspected scammers it identified, and announced plans to discontinue the free version of Cliq in China moving forward, mirroring Microsoft’s approach.

Scammers, according to dozens of victim accounts shared on platforms like Xiaohongshu and Douyin, employ diverse strategies to find their targets. They masquerade as job recruiters offering open positions, prospective renters contacting landlords, potential romantic partners on dating apps like Tinder, and even international buyers seeking to source products from Chinese factories. Once a connection is established, the goal is always to migrate the conversation to one of these Western business applications.

A key element of the scam involves the exploitation of these apps’ enterprise features. Scammers create accounts for their targets and then provide them with pre-made login credentials. This grants the scammers control over the "organization" within the app, allowing them to deactivate the accounts once the fraud is complete. This effectively wipes out the victims’ access to chat histories, which could otherwise serve as crucial evidence for law enforcement. To justify this unusual setup, scammers often concoct elaborate excuses, claiming they are using work devices that only permit certain applications, or that they created a "private" account specifically for their exclusive communication.

Zhao’s determination to understand the scam led her to a startling discovery. Through other victims she contacted, she obtained login credentials for an account used by the very same scammer who defrauded her. Posing as a new potential victim, Zhao re-engaged him, seeking to uncover more details about his modus operandi. She inquired why he insisted on using Teams instead of WeChat, China’s ubiquitous messaging app. The scammer’s response was telling: he claimed his colleagues could monitor his WeChat messages due to a work project, making Teams their "secret base together." He further asserted that the account he provided was "for team members to contact family while on the project." When Zhao probed about her specific username, "joy20706905," he vaguely replied that "the account was assigned by the software when you purchase it from Microsoft."

A notable development in Zhao’s second interaction was the presence of a warning banner within Teams. When she was initially defrauded in May, no such alert appeared. However, in August, the app displayed a banner stating: "Don’t share confidential info or your screen with people you don’t know. Report anything suspicious." This indicates Microsoft’s belated efforts to combat the problem.

The choice of these Western business applications by fraudsters is not arbitrary. In many ways, they present an ideal environment for scams in China. Unlike platforms such as Telegram or WhatsApp, they are not blocked by the Chinese government, ensuring uninterrupted communication. They also boast advanced tools like screen sharing and remote control, which scammers can potentially exploit to gain greater access and control over victims’ devices or guide them through fraudulent transactions. Most importantly, their status as legitimate workplace communication apps developed by trusted multinational tech companies lends an air of credibility that is crucial for building rapport and trust with victims.

These same factors contributed to a near-miss experience for Tan Chenxin, a Chinese software engineer living in New York. Earlier this week, Tan received a call from someone claiming to be involved in a joint police investigation with US Customs and Border Protection and Chinese law enforcement. They instructed him to download Webex and join a video call to discuss the fabricated situation. "I looked up Webex and found that it was developed by Cisco, a world-leading cybersecurity software provider," Tan recalled. "I happen to know what Cisco is, so I convinced myself it was fine." Fortunately, Tan recognized the hallmarks of a scam before transferring any money and quickly hung up. He noted, however, the difficulty in finding an easy way to report the scammer’s account to Webex, highlighting a gap in the reporting mechanisms of some Western platforms.

Compared to their Chinese counterparts, which have grappled with rampant investment fraud scams for years, Western platforms appear less prepared to combat this specific issue. Chinese messaging apps like WeChat and Xiaohongshu frequently employ sophisticated algorithms to flag potential scam risks to users, even within private conversations, when keywords related to investments and payments are detected. Indeed, even WIRED’s own conversations with scam victims on Xiaohongshu triggered repeated warnings as they recounted their experiences of being defrauded. This proactive approach by Chinese platforms stands in contrast to the reactive measures observed on some Western apps, underscoring the ongoing challenge in adapting global communication tools to diverse local threat landscapes. The widespread exploitation of these trusted apps underscores the urgent need for enhanced security measures and more robust user protection mechanisms across the board.