I've received an email that claims to be from Microsoft and would like to verify that it actually is .

Treat this email as phishing unless its full sender details and message headers authenticate it as Microsoft; do not click its links, reply, or download attachments.

The generic greeting, grammatical errors, vague “latest Regulations,” and pressure to verify an address before email can be used are strong phishing indicators. Microsoft identifies unexpected messages, errors, requests for information, mismatched domains, and suspicious links as common warning signs.^1^

Verify it safely

1. Check the actual sender address
   • In Outlook.com, hover over or select the sender’s display name to reveal the complete address.
   • Do not rely on the displayed name “Microsoft”; sender names and addresses can be spoofed.
   • Microsoft documents @accountprotection.microsoft.com as its trusted domain for Microsoft-account security notifications and account updates.^2^
   • A Gmail address, misspelled Microsoft domain, or unrelated domain indicates phishing. Even a plausible-looking address is not sufficient by itself.
2. Check Outlook’s warning indicators
   • A ? sender icon, an unverified sender warning, or a via address different from the visible From address indicates that Outlook could not verify the claimed identity or detected a mismatch.^3^
   • A yellow or red safety bar is another reason not to interact with the message.^4^
3. Do not use the email’s verification button
   • Open a new browser window and manually navigate to Outlook.com or your Microsoft account.
   • Check whether the account works normally and review the account’s Recent activity page for unfamiliar sign-ins or security challenges. Microsoft recommends checking account activity directly rather than trusting an unexpected notification.^4^
   • If the email concerns a real account requirement, verify it from the account itself—not through the message.
4. Optionally inspect the message headers
   • Headers expose authentication and routing information that the visible From field does not. Microsoft specifically recommends checking them when validating account-team email.^2^
   • If interpreting SPF, DKIM, DMARC, and routing results is unfamiliar, reporting the original message through Outlook is safer than trying to validate it manually.

Report and remove it

In Outlook.com:

1. Select the message without opening any link.
2. Above the reading pane, choose Report → Report phishing.
3. Delete the message afterward if it remains in the mailbox.

This reports the sender, removes the message from the inbox, and helps improve Microsoft’s filtering.^3^

If using a different email application, attach the original message to a new email and send it to [Email]; do not simply forward it, because Microsoft needs the original headers.^1^

If you already clicked or entered information

• If you only opened the message, no account action is normally needed; report and delete it.
• If you entered a Microsoft password, change it immediately by navigating directly to the Microsoft account site, and change that password anywhere else it was reused.
• Review recent account activity and security information for unknown changes.
• If payment information was entered, contact the bank or card issuer immediately.
• On a work or school device, notify the organization’s IT or security team. Microsoft’s phishing recovery guidance recommends changing affected passwords and reporting possible financial fraud promptly.^1^

References

1. Protect yourself from phishing
2. Can I trust email from the Microsoft account team? | Microsoft Support
3. Phishing and suspicious behavior in Outlook | Microsoft Support
4. Help protect your Outlook.com email account | Microsoft Support