How to tell if a "Microsoft" email is a scam
Published
Short answer: Don't click anything in the email. Instead, type account.microsoft.com into your browser and check your account yourself. Real Microsoft account security alerts come from account-security-noreply@accountprotection.microsoft.com, and Microsoft's error and warning messages never include a phone number. An email that pressures you to act fast, asks for a password or payment, or gives you a number to call is almost certainly a scam.
Signs it's a scam
- The sender's actual email address isn't from Microsoft. Look at the address, not just the name shown.
- It pushes you to act now: your account will close, a payment failed, your storage is full, or someone signed in.
- It asks for your password, card details, or payment in gift cards or cryptocurrency. Microsoft says it will never ask you to pay for support that way.
- It gives you a phone number to call. Microsoft's error and warning messages never include a phone number.
- Links go somewhere other than a microsoft.com address. On a computer, hover over a link to see where it really goes; on a phone, press and hold it.
- It has an attachment you weren't expecting.
What to do with a suspicious email
- Don't click, open or call. Don't click links, open attachments or call any number in the email.
- Check your account yourself. Type account.microsoft.com into your browser, sign in, and look at Security. The Recent activity page shows sign-ins to your account from the last 30 days.
- Report it. In Outlook.com or Outlook for Microsoft 365, select Report > Report phishing. In another email app, attach the message (don't forward it) to a new email to phish@office365.microsoft.com. You can also forward it to reportphishing@apwg.org, as the FTC suggests.
- Delete it. Once it's reported, delete it.
If you already clicked or replied
- Change your Microsoft password from a different device you trust, and turn on two-step verification.
- Check Recent activity for sign-ins you don't recognize.
- If you entered card or bank details, call your bank using the number on your card.
- If you let someone connect to your computer, disconnect it from the internet and have it checked before you use it for banking or email.
- If you lost money, report it to the FTC at ReportFraud.ftc.gov.
When to call a pro
Call a pro if you let a caller or website connect to your computer, entered your password on a fake page, or your account is sending messages you didn't write. Checking and cleaning up a computer is usually one Remote Session ($99).
Related: Virus and malware removal · Prices · More guides
Sources
- Microsoft: Protect yourself from phishing
- Microsoft: Protect yourself from tech support scams
- Microsoft: What happens if there's an unusual sign-in to your account
- Microsoft: What is the Recent activity page
- FTC: How to recognize and avoid phishing scams
Still stuck?
Tell us what's happening. You'll get a flat price before any work starts.