Microsoft Teams to Introduce Automated Brand Impersonation Protection
Microsoft is rolling out a new "Brand Impersonation Protection" feature for Teams Calling to automatically alert users to suspicious, high-risk VoIP calls from external impersonators.
Microsoft is set to introduce a new security feature for Microsoft Teams Calling designed to combat the rising threat of social engineering through VoIP-based brand impersonation. The feature, dubbed "Brand Impersonation Protection," will automatically flag suspicious inbound calls from external parties who have not previously contacted the user, specifically targeting those attempting to masquerade as trusted organizations Help Net Security.
The technical mechanism behind this protection involves an automated evaluation of incoming VoIP traffic. When a call is initiated by a first-time external caller, the system analyzes the call metadata and signaling for indicators of brand impersonation. If the system identifies a high-risk signature, it will display a warning to the recipient before they answer the call. Should the user choose to proceed, the system is designed to maintain these alerts throughout the duration of the conversation to ensure the user remains aware of the potential risk Help Net Security.
Upon receiving a flagged call, users are presented with options to accept, block, or immediately end the communication. This functionality is intended to provide a layer of defense against sophisticated attackers who leverage the perceived legitimacy of Teams calls to conduct phishing or credential harvesting campaigns. By providing real-time warnings, Microsoft aims to reduce the success rate of social engineering attacks that rely on impersonating reputable brands Help Net Security.
The rollout of this feature is scheduled to begin in mid-May 2026, with full deployment expected by the end of the month. Microsoft has confirmed that the feature will be enabled by default for all users, and existing Teams Calling policies will remain unaffected by the update. No immediate administrative action is required to enable the protection, though organizations are encouraged to update their internal security awareness training and prepare helpdesk staff for potential user inquiries regarding the new alerts Help Net Security.
As organizations increasingly rely on unified communications platforms for external collaboration, these environments have become prime targets for threat actors. The implementation of automated brand impersonation detection reflects a broader industry trend toward integrating security directly into communication workflows. Microsoft has indicated that further documentation regarding caller ID security will be released in conjunction with the deployment to assist administrators in managing these new safeguards Help Net Security.