Possible phishing scam?

Question

Possible phishing scam?

Andrea Leinen 0

I received 3 emails simultaneously this morning from the “Microsoft account team” about suspicious activity. How do I tell if they are legitimate?

0 comments

2 answers

Your answer

Answer 1

A legitimate email from Microsoft regarding your account always comes from domains ending in @accountprotection.microsoft.com

Please also make sure you review all recent activities on your account https://account.live.com > Security.

If you see anything that's not yours, I suggest you go through this list to review and secure your account.

Please complete these steps on a computer, not on a smartphone or tablet.

====================

First, go to https://www.outlook.com and sign in.

Click the gear icon in the top right corner to open Settings.

Under Mail, review the following areas:

Rules

If any rules are listed, delete all of them.

Conditional formatting

If anything is set up there, delete it.

Forwarding and IMAP

If you see any entries or settings you did not create, remove them. Turn off POP and IMAP.

Junk

Review Safe sender and blocked list. If you don't recognize any, remove them.

After that, exit Settings and return to outlook.com.

Open the To Do section by clicking the blue checkmark icon on the left side. Delete anything there that was not created by you.

====================

Go to https://account.live.com.

Under Your info > Sign-in preferences, review all aliases on the account. If you see any alias you do not recognize, remove it.

Next, go to the Devices section of your Microsoft account and remove any devices you do not recognize.

====================

Please also do the following in Security section

Change your password

Enable two-step verification

====================

Go here https://account.microsoft.com/privacy/app-access Click on "Don't allow" for anything you don't recognize.

=======================

Then go to Security > Manage how I sign in and make sure all contact information belongs to you.

On that same page, scroll down to App passwords and remove any existing app passwords.

Also on the same page, click on Sign out everywhere. This is intended to disconnect any active sessions that may still be connected. Please note that this can take up to 24 hours to fully take effect.

Answer 2

Treat the emails as suspicious until verified.

Use these checks:

Check the sender domain Microsoft support emails use these domains:
- microsoft.com
- microsoftsupport.com
- mail.support.microsoft.com
- office365support.com
- techsupport.microsoft.com
If the message comes from a different domain, it is likely phishing.
Do not use links or attachments in the email Do not reply, click links, or open attachments while verifying the message.
Inspect Outlook warning signs In Outlook, be cautious if:
- the sender shows a ? image, which means the sender could not be verified
- the message shows a via tag, meaning the real sending address differs from the From address
Hover over links, buttons, and addresses Verify that links and addresses point to Microsoft and look valid before taking any action.
Check account activity directly If the emails claim suspicious sign-in activity, verify it by going directly to the Microsoft account Recent activity page: See your recent activity
If unusual activity is shown, secure the account Go to the Security settings page and change the password and update security settings:
- Security settings page
- Change your password

A legitimate-looking message can still be spoofed. Multiple emails arriving at the same time does not make them legitimate. The safest confirmation is whether the same alert appears in the Microsoft account Recent activity or security pages.

References: