Your company is participating in a Cyber Security Education Program.

This MFA QR Phishing Attack included the following social engineering techniques:

1. Spoofed email and domain (example: locked-outlook.com).
2. Urgency to act (example: expiring today).
3. QR code to allow you take action attacker wants and also move you outside the protection of your IT system.
4. Verbiage and logos of tools you use to catch attention (example: Microsoft).

How to spot this was a phishing email:

1. Was this an email you expected to receive? No - Be cautious
2. Changes to MFA (workflow) would be communicated in official channels.
3. The sender email address was not associated with Microsoft.
4. Example: @locked-outlook.com ... is not a primary domain associated with Microsoft; the use of "outlook" is to imply Microsoft ownership.
5. The link preview from QR scanning identified suspicious domain similar to above.