Microsoft Teams Flags Suspicious One-to-One Calls with

Microsoft Teams is integrating a new security feature designed to help organizations detect and stop voice-based scams and phishing attacks.

The new “Report a Call” button will allow users to flag suspicious one-to-one calls directly from their Teams call history.

As use of Microsoft Teams calling continues to grow, attackers are increasingly using voice calls to trick employees into sharing credentials, financial details, or sensitive business information.

Until now, users had no easy way to report such calls, leaving security teams with limited visibility into these threats.

How the ‘Report a Call’ Feature Works

With this update, a new “Report a Call” option will appear in the call history for one-to-one calls on Teams for Windows, Mac, and the web.

Users will be able to click the three-dot “more options” menu next to a call entry and select “Report a Call” if they believe it is suspicious, a scam, or an unwanted external contact.

When a call is reported, Microsoft says that only limited call metadata and contextual information will be shared with the organization and Microsoft.

This includes details such as the call time and duration, caller ID (if available), Teams user IDs of the participants, and the user’s reason for reporting, if they choose to provide it. No call audio is mentioned as being shared.

Security teams will be able to review and investigate reported calls in the Microsoft Defender portal, provided they have Defender for Office 365 Plan 1 or Plan 2, or Microsoft Defender XDR.

Admins can also see user-reported call data in the Teams Admin Center under Analytics & Reports > Protection reports > User-reported security submissions.

The feature will be enabled by default on Teams clients, but organizations can control the experience.

Admins can turn off the “Report a Call” option from the Teams Admin Center under Calling settings if they do not want users to submit call reports.

For richer insights, Microsoft advises enabling Teams call reporting in the Microsoft Defender portal so detailed submissions appear there.

Rollout for targeted release tenants is planned to begin in mid-March 2026 and be completed by late March 2026. General availability worldwide is expected between mid- and late April 2026.

Microsoft recommends that organizations proactively inform users about the new option and explain when to use it for suspicious, scam-like, or unwanted calls.

So that user reports can strengthen organization-wide protection against voice-based threats.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.