Online Threat Alerts (OTA) - Alerting you to scams and frauds.
The email message below: "Microsoft account unusual sign-in activity," is a fake. The email message was NOT sent by Microsoft and is a phishing scam created by cybercriminals to steal Microsoft, MSN, Hotmail, Live or Outlook usernames and passwords. Therefore, recipients of the fake email message are asked not to click on the links or follow the instructions in it. Microsoft email users who have received similar emails and who want to know if there is something actually wrong with their accounts, may go directly to www.outlook.com, www.hotmail.com or www.live.com and sign into their accounts. If there is something wrong, or if there is something that needs to be done on their accounts, they will be notified after signing in.
It is recommended that Microsoft Hotmail, Live or Outlook users never click on a link to sign into their accounts. They should go directly to www.outlook.com, www.hotmail.com or www.live.com sign-in from there instead.
From: Outlook Administrator messagecennterdebt@outlook.comDate: September 8, 2016 at 8:46:48 AM EDTSubject: Microsoft account unusual sign-in activityUnusual Activity DetectedWe detected something unusual about a recent activity to the Microsoft account. To help keep you safe, we required an extra security challenge. You will need to verify your Microsoft email account below to confirm that the recent activity was yours and to regain access and enjoy our unlimited service.Verify NowWhat happened?Using a shared computer to access your account.Logging in your microsoft account from blacklisted IP.Not logging off your account after usage.Thanks for using your Microsoft account to bring the people who matter most together in one place. You can change your connection settings anytime and find more ways to connect at businnesmn.com/content/themes/ fourteen/genericons/font/dirrect.php.See you online,The Microsoft team
From: Outlook Administrator messagecennterdebt@outlook.comDate: September 8, 2016 at 8:46:48 AM EDTSubject: Microsoft account unusual sign-in activity
Unusual Activity Detected
We detected something unusual about a recent activity to the Microsoft account. To help keep you safe, we required an extra security challenge. You will need to verify your Microsoft email account below to confirm that the recent activity was yours and to regain access and enjoy our unlimited service.
Verify Now
What happened?
Using a shared computer to access your account.
Logging in your microsoft account from blacklisted IP.
Not logging off your account after usage.
Thanks for using your Microsoft account to bring the people who matter most together in one place. You can change your connection settings anytime and find more ways to connect at businnesmn.com/content/themes/ fourteen/genericons/font/dirrect.php.
See you online,The Microsoft team
The links in the phishing email message go to the following fake and phishing website:
If you were tricked into entering your username and password on the fake MSN / Hotmail / Live / Outlook webpage, please change your password immediately.
Click here to change your password.
Check the comment section below for answers or additional information. Share what you know, or ask a question about this article by leaving a comment below.
Online Threat Alerts (OTA) is not affiliated with or endorsed by any trademark owner mentioned in this article. Some of the information in samples in this article may have been impersonated or spoofed.
33
"Hello,We Have Detected Unusual Activity With Your Windows Account on Your Computer.Login Has Occurred on 08/10/2019 - 5:23 AM EST From IP: 128.58.457.54 GeoLocation Found: Eastern Russia.If This Was Not You Please Call the Windows Security Team at 1-858-451-4210.(Be at your computer)Windows Security Team1-858-451-4210"Here is another scam.
This appears to be another similar message:"Account unusual sign-in activityHello,We Have Detected Unusual Activity With Your Windows Account on Your Computer.Login Has Occurred on 08/10/2019 - 5:23 AM EST From IP: 128.58.457.54 GeoLocation Found: Eastern Russia.If This Was Not You Please Call the Windows Security Team at 1-858-451-4210.(Be at your computer)Windows Security Team1-858-451-4210"
Yes, it is another scam.
"From: Microsoft Sent: Tuesday, July 9, 2019 9:52 AMSubject: Microsoft Office 365 Sign-In Activity Make business tasks easier View it onlineMicrosoft Office 365 Sign-In ActivityMicrosoft takes securing your email service seriously, your mail servers reported unusual email activity we'd like you to address, click to view reports belowhxxp://ecyclingusa.com/wp-includes/js/dist/vendor/ View Report Run and grow your business with these apps" Outlook Customer ManagerAutomatically organizes information,Here is another scam.
Here is another scam:"Security InformationOutlook service Today, 7:58 AMDear subscriber,We have detected an unusual recent connection to your Microsoft account. For security reasons your mail will be temporarily blocked in order to continue using our services, please follow the procedure Click hereThank you for using our servicesCopyright 2018"
Here is another scam:"From: Outlook.com -Hotmail- Office Support Date: 21 August 2018 at 14:22:31 BSTSubject: Temporary error: Email Delivery failed!e-Mail: Unusual sign-in activityHello, We detected something unusual about a recent sign-in to the Microsoft account. Review recent activity The information in this electronic e.Mail message is private and confidential, and only intended for the addressee. Thanks, Nick LaneMicrosoftOutlook account team"
This must be a scam:"Microsoft account team Unsubscribe12:02 PM (1 hour ago)to me Microsoft accountUnusual sign-in activityWe detected something unusual about a recent sign-in to the Microsoft account *****-gmail.com.Sign-in detailsCountry/region: VietnamIP address: 115.79.32.243Date: 6/15/2018 12:02 PM (PST)Platform: WindowsBrowser: FirefoxPlease go to your recent activity page to let us know whether or not this was you. If this wasn't you, we'll help you secure your account. If this was you, we'll trust similar activity in the future.Review recent activityTo opt out or change where you receive security notifications, click here.Thanks,The Microsoft account team
Just got this one. Different details, but same exact format. Figured it was a scam, email pushed it to my "junk" folder. Just looked over my MS account (not through their "Review Recent Activity" link, of course), everything looks normal. Figured I'd do some additional digging to be sure.Thanks for the info.
I got a similar email (claiming that my account was signed into from Vietnam as well, but a different IP address) - only, my account is with Gmail!They must have gotten something mixed up there...Usually such emails come from Google. I did click the link (silly me!) but didn't enter passwords or anything. Hopefully my computer will be okay...
Yes, you are OK.
Here is another scam:"From: Microsoft Office365 [account-security-noreply-accountprotection.com]Sent: Wednesday, 30 May 2018 1:10 AMSubject: Microsoft account unusual sign-in activityMicrosoft accountUnusual sign-in activityWe detected something unusual about a recent sign-in to your Microsoft Office 365 account with email address .Sign-in details:Country/region: RussiaIP address: 213.183.58.12Date: 9/01/2018 11:32 AM (PST)If this was you, then you can safely ignore this email.If you're not sure this was you, a malicious user might have your password.To help keep you safe, we required you to review your Office 365 E-mail account by sign-in into your Office 365 E-mail account, you will be introduced to new term of Microsoft service agreement that will strengthen the security of your Microsoft E-mail account.Review recent activityWe'll help you take corrective action after you review has your Office 365 E-mail account.This message was sent to . To opt out or change where you receive security notifications, click here.Thanks,The Microsoft account team"
Here is another scam:-------- Original message --------From: Microsoft account team Date: 4/6/2018 5:04 PM (GMT-06:00) Subject: Your account will be deactivated Microsoft accountUnusual sign-in activityThis is to inform you that your request on: 04/04/2018 09:18:02.PM. to remove your account meweaz-*****.*** from outlook.com server has been approved and will initiate in one hour from the exact time you open this message. Regards. ignore this message to continue with email removal or If this deactivation was not requested by you Please reply us. If You Receive This Message In Your Junk or Spam Its Due to Your Internet Provider
Here is another scam:"From: Microsoft account team Sent: Monday, April 9, 2018 11:45 PMSubject: Microsoft account unusual sign-in activityMicrosoft accountVerify your accountWe detected something unusual about a recent sign-in for the Microsoft account jn*****-msn.com. For example, you might be signing in from a new location, device, or app.To help keep you safe, we've blocked access to your inbox, contacts list, and calendar for that sign-in. Please review your recent activity and we'll help you secure your account. To regain access, you'll need to confirm that the recent activity was yours.Review recent activityThanks,The Microsoft account team"
I got the same number being used in a hoax, but with a typo related to being a non-English speaker... what idiots!
account-security-noreply- accountprotection.microsoft.com SAID I NEEDED TO SIGN IN TO MY ACCOUNT?
My latest one was a lot more convincing. The hyperlink was to https://account.microsoft.com/activity that looks a lot more plausible.
Here is another scam:"From: ACCOUNT TEAM OFFICE <327453278-345nbd.com>Sent: Monday, October 9, 2017 7:53:29 AMTo: team-member-noreply-outlook.comSubject: ID: 133 - Email Security Alert! (Oct. 2017) MT Unusual Activity DetectedWe detected something unusual about a recent activity to your e-mail account. To help keep you safe, we required an extra security challenge. You will need to verify your email account below to confirm that the recent activity was yours and to regain access and enjoy our unlimited service. Failure to verify will lead to permanent suspension of your accountWhat happened? Verify Now Using a shared computer to access your account.Logging in your account from blacklisted IP.Not logging off your account after usage.Thanks for using your account to bring the people who matter most together in one place. You can change your connection settings anytime and find more ways to connect.See you online,The account team"
Here is another scam:"From: Microsoft.com account TeamSent: Sunday, 23 July, 08:49Subject: Customer ID: 1202: Microsoft account security warningTo: account-security-noreply-account.microsoft.comVerify your accountDear user,We detected something unusual about a recent sign-in for your account. Might be due to the following reasons.1. A recent change in your personal information. (eg: address, phone)2. Illegal attempt to use your account from a different location.3. Virus attachment without specific recipient.To help keep you safe, we've blocked access to your inbox, contacts list, and calendar for that, please verify your account to regain access. Kindly sign-in from your regular device.Verify account nowPlease follow the security verification to keep your account safe. Thanks, Customer account team"
"account-security-noreply-accountprotection.microsoft.com." Is this a genuine email from Microsoft?
I had that same email address come though a few days ago, but the fact I could still access my email account meant it had to be bogus. Best thing is to try and log in from the outlook site, if you think the email is fake.
No. The address was created by cyber criminals to trick recipients of their scams into believing their fake or phishing email messages are real.
Here is another scam:"From: account-security-noreply-account.microsoft.com Sent: 25 April 2017 07:33Subject: Unusual sign-in activity! Microsoft account Receiver: helenwilson35-hotmail.com Security info replacement Someone started a process to replace all of the security info for the Microsoft account helenwilson35-hotmail.comIf this was you, you can safely ignore this email. Your security info will be replaced with 447810683552 when the 30-day waiting period is up. If this wasn't you, someone else might be trying to take over helenwilson35-hotmail.com Click here and we'll help you protect this account."
I have this phishing scam email pop up every time I open Live Mail. It must reside on my pc. There are lots of warnings about this scam but no information how to get rid of it. I have tried several anti-virus programs to no avail.How do I get rid of or block this scam email?RegardsMal
What does the phishing message says?Click here to try a program called AdwCleaner that I think can remove the Malware on your PC.And, if the program above does not work, try and uninstall and then reinstall Live Mail.
Malicious popup to sign in to Hotmail to receive messages immediately after Firefox downloads. This happened after password was changed. Told twice to enter new password.
Here is another scam:"From: Message311.ByHotmail.311605-gw.novell.comSent: February 8, 2017 9:48 AMSubject: E-mail Account Alert! [ID-KEF311] Unusual email account activity!Error-ID: [311-KE-311]We`re having a problem verifying your email account information. You might not be able to see all your email messages due to several security concerns. We will start working on fixing the problem as soon as you verify your account details.To ensure that your email service is not interrupted, we request you to confirm and update your information today by following the link below:(c) The Microsoft account team 2017"
Here is another scam:"From: Windows E-mail Service [mailto:bryanmark-terminal21sall.com] Sent: Thursday, December 08, 2016 4:07 AMTo: noreplyoffice-msnteam.comSubject: Action Required: Mail on Stopped (Final Warning) Microsoft Unusual Activity DetectedWe detected something unusual about a recent activity to your microsoft e-mail account. To help keep you safe, we required an extra security challenge. You will need to verify your microsoft email account below to confirm that the recent activity was yours and to regain access and enjoy our unlimited service. Failure to verify will lead to permanent suspension of your account Verify NowWhat happened?Using a shared computer to access your account.Logging in your microsoft account from blacklisted IP.Not logging off your account after usage.Thanks for using your Microsoft account to bring the people who matter most together in one place. You can change your connection settings anytime and find more ways to connect at https://profile.live.com/services.See you online,The Microsoft team"
Thank you. I received a message like that.
Here is another scam:"From: Outlook TeamSent: 16 November 2016 08:41Subject: Microsoft account unusual sign-in activity Your Account Will be BlockedDear User,We are contacting you to inform you that our Microsoft Account Review Team identifiedsome unusual errors in your Microsoft account profile. This may be due to the followingUsing a shared computer to access your Microsoft Outlook account.Logging in your Microsoft Outlook account from blacklisted IPNot logging off your Microsoft Outlook account after usage.In order to safeguard your account, we require that you confirm your Outlook AccountAccess the following link to complete the verification of your Outlook Account.Unblock Verify Now Thanks,Microsoft ID Customer Support Copyright 2016 Inc. All rights reserved. Terms of Service,Microsoft Account Team."
I got it and stupidly fell for it. The PRIMARY reason for this potential tragedy is that Microsoft has conditioned me to respond to such requests. From time to time, Microsoft decides to force password changes even though I will swear to God himself that my own account is blameless and not in need of action.It burns a *lot* of time and causes errors and sometimes extended expensive temporary loss of access when they do that. It happens so often, for NO REASONABLE CAUSE, that finally this time I shot myself in the foot when an imposter came calling.This dumbing down, sheep treatment by Microsoft has [somewhat] worn me into a dumb sheep. Their mantra of Deproductivity has claimed, for a moment anyway, one more victim.Microsoft designers in many, many, many technical regards the most technologically inept designers in history, and with the power that they yield, their ineptness inflicts untold damage on the world as they damage productivity. Before Microsoft, the U.S. ascended to superiority in all aspects of science and technology. Since Microsoft, that superiority has partially crumbled. Microsoft is a huge factor in that. Don't be fooled by clueless fanboy journalism. They are to a huge degree self-deluded imbeciles.I wish the Justice Department would quit jerking off and go ahead and bust their monopoly!
Here is another scam:"From: Outlook©Sent: Saturday, September 24, 2016 6:25 AMUnusual Activity DetectedWe detected something unusual about a recent activity to your microsoft e-mail account. To help keep you safe, we required an extra security challenge. You will need to verify your microsoft email account below to confirm that the recent activity was yours and to regain access and enjoy our unlimited service. Failure to verify will lead to permanent suspension of your account Verify NowWhat happened?Using a shared computer to access your account.Logging in your microsoft account from blacklisted IP.Not logging off your account after usage.Thanks for using your Microsoft account to bring the people who matter most together in one place. You can change your connection settings anytime and find more ways to connect at https://profile.live.com/services.See you online,The Microsoft team"
Here is another phishing message:"From: AbdulMougheeth HalfawiSent: Monday, September 19, 2016 9:19 PMSubject: Microsoft account unusual sign-in activityWelcome to new Outlook.comDue to the ongoing update in our system/server you are required to re-verify your account within 24 hours to enable us register your country/device in our database. Failure to re-verify your account will lead to account de-activation and you will no longer have access to many of the features for improved Conversations, contacts and attachments.Take a minute to re-verify your account for a faster, safer and full-featured Microsoft Outlook experience.Your security tight is our concern! Click here to re-verify your accountThank you for using Microsoft products and services."
I have had a similar email this morning about an old Microsoft account and email that I no longer use, plus I revived the same message via SMS. I didn't click any links as it looked phishy...