Account blocked due to malicious activity

Question

Account blocked due to malicious activity

Jerry 21

More of a report that I can't determine where to send it. My account was blocked due to malicious activity. However, the block appears to have been initiated because I ignored a bunch of emails that were basically ransom demands. They stated my account would be blocked because of suspect activity unless I clicked on a link to sign into MS and provide information. None of these emails were from Microsoft and the last dozen were over the top attention grabbing warnings. My best guess is they knew how to trigger Microsoft's automatic system and have the account blocked. It is now restored and there is no indication in any form that they ever had access to my account.

0 comments

2 answers

Your answer

Answer 1

@Jerry said

More of a report that I can't determine where to send it

https://substrate.office.com/ip-domain-management-snds/Postmaster/Policies

To report unlawful, abusive, unwanted or malicious email that you find originating from an Outlook.com, Hotmail, Live, or MSN account, please forward a complete copy of the abusive message (including the full message header) to ******@outlook.com. Sending these types of communications is a violation of Microsoft policy and appropriate action will be taken on confirmed reports.

https://reportfraud.microsoft.com/en-au

If you have been contacted through unsolicited phone calls, emails, pop-up messages or other means by someone claiming to be from, or associated with, Microsoft and believe it was a scam, you can use this form to report all the information regarding your interaction with them.

Answer 2

That pattern aligns with spoofed phishing or extortion email, not proof that the account was actually accessed. Microsoft notes that unusual activity can trigger extra verification or a temporary suspension, and the Recent activity page can show events such as Unusual activity detected, Sign-in blocked (Account compromised), or Sign-in blocked (Account temporarily suspended).

If the account is already restored and there is no evidence of access, the practical next checks are:

Review Recent activity on the Microsoft account and look for unknown successful sign-ins, locations, or security changes.
Check for signs of compromise such as:
- missing or deleted mail
- suspicious Inbox rules
- suspicious messages in Sent Items or Deleted Items
- unexpected password changes or lockouts
If the account is blocked again, use the Microsoft account recovery or unlock flow:
- sign in at https://account.microsoft.com
- if available, complete Let's prove you're human
- if that option does not appear, use the reinstatement link shown in the lock window and submit the form once
If OneDrive shows Your account is currently unavailable, use the Microsoft services account reset page and follow the on-screen steps. If the account was recently verified by text message or many files were shared, the block can clear within 24 hours.

For the report itself, the available support path in the provided guidance is Microsoft Support for personal accounts, or the Microsoft Community. For work or school accounts, the path is the organization IT helpdesk or admin.