Online Threat Alerts (OTA) - Alerting you to scams and frauds.
Microsoft Account Team Email Unusual Sign-in Activity Scam

Emails claiming to be from the "Microsoft account team" about "unusual sign-in activity" are heavily spoofed by scammers. Scammers use these alerts to create urgency and panic. Their goal is to trick you into clicking a link that leads to a fake login page designed to steal your password.

How to Tell if the Alert is Real

  • Check the Sender Address: Legitimate Microsoft security notifications are only sent from account-security-noreply@accountprotection.microsoft.com. If the email comes from a generic address (like @outlook.com or @gmail.com) or a slightly misspelled domain, it is a scam.
  • Look for Action Required: Genuine Microsoft security emails do not typically require you to click a button in the email to log in.
  • Do Not Click Links: Avoid clicking any links in the suspicious email. Scammers often use URL shorteners or deceptive hyperlinks that look real but direct you to a phishing site.

What to Do If You Receive an Alert

Instead of clicking the link in the email, manually check your account status:

  1. Open your web browser and go directly to Microsoft Account.
  2. Log in with your email and password.
  3. Go to the Security tab and select Review activity.
  4. Here, you will see a list of actual logins and security challenges. If you do not see any matching sign-ins on this page for the dates mentioned in the email, the email is a scam and can be deleted.

How to Protect Your Account

If you suspect someone is trying to access your account, or if you received a real alert:

  • Change Your Password: Create a strong, unique password on the official Microsoft portal.
  • Enable 2FA: Set up two-step verification on your account for added protection.
  • Update Security Info: Ensure your recovery phone number and alternate email address are current.
  • Report the Scam: You can mark the suspicious email as junk or phishing in Outlook using the Microsoft Support reporting tool.
waiting