Online Threat Alerts (OTA) - Alerting you to scams and frauds.

Microsoft Account Unusual Sign-in Activity Scam
Microsoft Account Unusual Sign-in Activity Scam

The email message below: "Microsoft account unusual sign-in activity," is a fake. The email message was NOT sent by Microsoft and is a phishing scam created by cybercriminals to steal Microsoft, MSN, Hotmail, Live or Outlook usernames and passwords. Therefore, recipients of the fake email message are asked not to click on the links or follow the instructions in it. Microsoft email users who have received similar emails and who want to know if there is something actually wrong with their accounts, may go directly to www.outlook.com, www.hotmail.com or www.live.com and sign into their accounts. If there is something wrong, or if there is something that needs to be done on their accounts, they will be notified after signing in.

It is recommended that Microsoft Hotmail, Live or Outlook users never click on a link to sign into their accounts. They should go directly to www.outlook.com, www.hotmail.com or www.live.com sign-in from there instead.

The "Microsoft Account Unusual Sign-in Activity" Phishing Scam

From: Outlook Administrator messagecennterdebt@outlook.com
Date: September 8, 2016 at 8:46:48 AM EDT
Subject: Microsoft account unusual sign-in activity

Unusual Activity Detected

We detected something unusual about a recent activity to the Microsoft account. To help keep you safe, we required an extra security challenge. You will need to verify your Microsoft email account below to confirm that the recent activity was yours and to regain access and enjoy our unlimited service.

Verify Now

What happened?

Using a shared computer to access your account.

Logging in your microsoft account from blacklisted IP.

Not logging off your account after usage.

Thanks for using your Microsoft account to bring the people who matter most together in one place. You can change your connection settings anytime and find more ways to connect at businnesmn.com/content/themes/ fourteen/genericons/font/dirrect.php.

See you online,
The Microsoft team

The links in the phishing email message go to the following fake and phishing website:

  • businnesmn.com

If you were tricked into entering your username and password on the fake MSN / Hotmail / Live / Outlook webpage, please change your password immediately.

Click here to change your password.

33

Comment sectionComments / Answers (33)

Remove sensitive information from your post. Your IP address will be used to display your estimated location.

Comment count 33

by info

"Hello,

We Have Detected Unusual Activity With Your Windows Account on Your Computer.

Login Has Occurred on 08/10/2019 - 5:23 AM EST From IP: 128.58.457.54 Geo
Location Found: Eastern Russia.

If This Was Not You Please Call the Windows Security Team at 1-858-451-4210.
(Be at your computer)

Windows Security Team
1-858-451-4210"

Here is another scam.

Delete


by an anonymous user from: Webster, New York, United States

This appears to be another similar message:

"Account unusual sign-in activity

Hello,

We Have Detected Unusual Activity With Your Windows Account on Your Computer.

Login Has Occurred on 08/10/2019 - 5:23 AM EST From IP: 128.58.457.54 Geo
Location Found: Eastern Russia.

If This Was Not You Please Call the Windows Security Team at 1-858-451-4210.
(Be at your computer)

Windows Security Team
1-858-451-4210"

Delete


by info

Yes, it is another scam.

Delete


by info

"From: Microsoft
Sent: Tuesday, July 9, 2019 9:52 AM
Subject: Microsoft Office 365 Sign-In Activity

Make business tasks easier View it online

Microsoft Office 365 Sign-In Activity
Microsoft takes securing your email service seriously, your mail servers reported unusual email activity we'd like you to address, click to view reports below

hxxp://ecyclingusa.com/wp-includes/js/dist/vendor/

View Report

Run and grow your business with these apps"
Outlook Customer Manager
Automatically organizes information,


Here is another scam.

Delete


by info

Here is another scam:

"Security Information
Outlook service
Today, 7:58 AM
Dear subscriber,



We have detected an unusual recent connection to your Microsoft account. For security reasons your mail will be temporarily blocked in order to continue using our services, please follow the procedure Click here

Thank you for using our services

Copyright 2018"

Delete



by info

Here is another scam:

"From: Outlook.com -Hotmail- Office Support
Date: 21 August 2018 at 14:22:31 BST
Subject: Temporary error: Email Delivery failed!

e-Mail:
Unusual sign-in activity

Hello,

We detected something unusual about a recent sign-in to the Microsoft account.

Review recent activity

The information in this electronic e.Mail message is private and confidential, and only intended for the addressee.

Thanks,

Nick Lane
MicrosoftOutlook account team"

Delete


by an anonymous user from: Fullerton, California, United States

This must be a scam:

"Microsoft account team Unsubscribe
12:02 PM (1 hour ago)
to me
Microsoft account
Unusual sign-in activity
We detected something unusual about a recent sign-in to the Microsoft account *****-gmail.com.

Sign-in details
Country/region: Vietnam
IP address: 115.79.32.243
Date: 6/15/2018 12:02 PM (PST)
Platform: Windows
Browser: Firefox

Please go to your recent activity page to let us know whether or not this was you. If this wasn't you, we'll help you secure your account. If this was you, we'll trust similar activity in the future.

Review recent activity
To opt out or change where you receive security notifications, click here.
Thanks,

The Microsoft account team

Delete


by an anonymous user from: Ulster Park, New York, United States

Just got this one. Different details, but same exact format. Figured it was a scam, email pushed it to my "junk" folder. Just looked over my MS account (not through their "Review Recent Activity" link, of course), everything looks normal. Figured I'd do some additional digging to be sure.

Thanks for the info.

Delete


by an anonymous user from: Halifax, Nova Scotia, Canada

I got a similar email (claiming that my account was signed into from Vietnam as well, but a different IP address) - only, my account is with Gmail!

They must have gotten something mixed up there...Usually such emails come from Google. I did click the link (silly me!) but didn't enter passwords or anything. Hopefully my computer will be okay...

Delete


by info

Yes, you are OK.

Delete


by info

Here is another scam:

"From: Microsoft Office365 [account-security-noreply-accountprotection.com]
Sent: Wednesday, 30 May 2018 1:10 AM
Subject: Microsoft account unusual sign-in activity

Microsoft account

Unusual sign-in activity

We detected something unusual about a recent sign-in to your Microsoft Office 365 account with email address .

Sign-in details:

Country/region: Russia

IP address: 213.183.58.12

Date: 9/01/2018 11:32 AM (PST)

If this was you, then you can safely ignore this email.

If you're not sure this was you, a malicious user might have your password.

To help keep you safe, we required you to review your Office 365 E-mail account by sign-in into your Office 365 E-mail account, you will be introduced to new term of Microsoft service agreement that will strengthen the security of your Microsoft E-mail account.

Review recent activity

We'll help you take corrective action after you review has your Office 365 E-mail account.

This message was sent to . To opt out or change where you receive security notifications, click here.

Thanks,

The Microsoft account team"

Delete


by info

Here is another scam:

-------- Original message --------
From: Microsoft account team
Date: 4/6/2018 5:04 PM (GMT-06:00)
Subject: Your account will be deactivated

Microsoft account

Unusual sign-in activity

This is to inform you that your request on: 04/04/2018 09:18:02.PM. to remove your account meweaz-*****.***

from outlook.com server has been approved and will initiate in one hour from the exact time you open this message. Regards. ignore this message to continue with email removal or If this deactivation was not requested by you Please reply us. If You Receive
This Message In Your Junk or Spam Its Due to Your Internet Provider

Delete


by info

Here is another scam:

"From: Microsoft account team
Sent: Monday, April 9, 2018 11:45 PM
Subject: Microsoft account unusual sign-in activity

Microsoft account

Verify your account

We detected something unusual about a recent sign-in for the Microsoft account jn*****-msn.com. For example, you might be signing in from a new location, device, or app.

To help keep you safe, we've blocked access to your inbox, contacts list, and calendar for that sign-in. Please review your recent activity and we'll help you secure your account. To regain access, you'll need to confirm that the recent activity was yours.

Review recent activity
Thanks,
The Microsoft account team"

Delete


by an anonymous user from: Houston, Texas, United States

I got the same number being used in a hoax, but with a typo related to being a non-English speaker... what idiots!

Delete


by an anonymous user from: Rockville, Maryland, United States

account-security-noreply- accountprotection.microsoft.com SAID I NEEDED TO SIGN IN TO MY ACCOUNT?

Delete


by an anonymous user from: Edgware, England, United Kingdom

My latest one was a lot more convincing. The hyperlink was to https://account.microsoft.com/activity that looks a lot more plausible.

Delete


by info

Here is another scam:

"From: ACCOUNT TEAM OFFICE <327453278-345nbd.com>
Sent: Monday, October 9, 2017 7:53:29 AM
To: team-member-noreply-outlook.com
Subject: ID: 133 - Email Security Alert! (Oct. 2017) MT

Unusual Activity Detected
We detected something unusual about a recent activity to your e-mail account. To help keep you safe, we required an extra security challenge. You will need to verify your email account below to confirm that the recent activity was yours and to regain access and enjoy our unlimited service. Failure to verify will lead to permanent suspension of your account

What happened? Verify Now
Using a shared computer to access your account.
Logging in your account from blacklisted IP.
Not logging off your account after usage.
Thanks for using your account to bring the people who matter most together in one place. You can change your connection settings anytime and find more ways to connect.

See you online,
The account team"

Delete


by info

Here is another scam:

"From: Microsoft.com account Team
Sent: Sunday, 23 July, 08:49
Subject: Customer ID: 1202: Microsoft account security warning
To: account-security-noreply-account.microsoft.com

Verify your account
Dear user,

We detected something unusual about a recent sign-in for your account. Might be due to the following reasons.

1. A recent change in your personal information. (eg: address, phone)
2. Illegal attempt to use your account from a different location.
3. Virus attachment without specific recipient.

To help keep you safe, we've blocked access to your inbox, contacts list, and calendar for that, please verify your account to regain access. Kindly sign-in from your regular device.

Verify account now

Please follow the security verification to keep your account safe.

Thanks,
Customer account team"

Delete


by an anonymous user from: Glasgow, Scotland, United Kingdom

"account-security-noreply-accountprotection.microsoft.com." Is this a genuine email from Microsoft?

Delete


by an anonymous user from: Dudley, England, United Kingdom

I had that same email address come though a few days ago, but the fact I could still access my email account meant it had to be bogus. Best thing is to try and log in from the outlook site, if you think the email is fake.

Delete


by info

No. The address was created by cyber criminals to trick recipients of their scams into believing their fake or phishing email messages are real.

Delete


by info

Here is another scam:

"From: account-security-noreply-account.microsoft.com
Sent: 25 April 2017 07:33
Subject: Unusual sign-in activity!

Microsoft account Receiver: helenwilson35-hotmail.com Security info replacement

Someone started a process to replace all of the security info for the Microsoft account helenwilson35-hotmail.com
If this was you, you can safely ignore this email.
Your security info will be replaced with 447810683552 when the 30-day waiting period is up.
If this wasn't you, someone else might be trying to take over helenwilson35-hotmail.com

Click here and we'll help you protect this account."

Delete


by an anonymous user from: Bathurst, New South Wales, Australia

I have this phishing scam email pop up every time I open Live Mail. It must reside on my pc. There are lots of warnings about this scam but no information how to get rid of it. I have tried several anti-virus programs to no avail.
How do I get rid of or block this scam email?
Regards
Mal

Delete


by info

What does the phishing message says?

Click here to try a program called AdwCleaner that I think can remove the Malware on your PC.

And, if the program above does not work, try and uninstall and then reinstall Live Mail.

Delete


by an anonymous user from: Boston, Massachusetts, United States

Malicious popup to sign in to Hotmail to receive messages immediately after Firefox downloads. This happened after password was changed. Told twice to enter new password.

Delete


by info

Here is another scam:

"From: Message311.ByHotmail.311605-gw.novell.com
Sent: February 8, 2017 9:48 AM
Subject: E-mail Account Alert! [ID-KEF311]

Unusual email account activity!

Error-ID: [311-KE-311]

We`re having a problem verifying your email account information.

You might not be able to see all your email messages due to several security concerns. We will start working on fixing the problem as soon as you verify your account details.

To ensure that your email service is not interrupted, we request you to confirm and update your information today by following the link below:

(c) The Microsoft account team 2017"

Delete


by info

Here is another scam:

"From: Windows E-mail Service [mailto:bryanmark-terminal21sall.com]
Sent: Thursday, December 08, 2016 4:07 AM
To: noreplyoffice-msnteam.com
Subject: Action Required: Mail on Stopped (Final Warning)

Microsoft

Unusual Activity Detected
We detected something unusual about a recent activity to your microsoft e-mail account. To help keep you safe, we required an extra security challenge. You will need to verify your microsoft email account below to confirm that the recent activity was yours and to regain access and enjoy our unlimited service. Failure to verify will lead to permanent suspension of your account

Verify Now

What happened?
Using a shared computer to access your account.
Logging in your microsoft account from blacklisted IP.
Not logging off your account after usage.
Thanks for using your Microsoft account to bring the people who matter most together in one place. You can change your connection settings anytime and find more ways to connect at https://profile.live.com/services.

See you online,
The Microsoft team"

Delete


by an anonymous user from: Jackson, New Jersey, United States

Thank you. I received a message like that.

Delete


by info

Here is another scam:

"From: Outlook Team
Sent: 16 November 2016 08:41
Subject: Microsoft account unusual sign-in activity

Your Account Will be Blocked

Dear User,

We are contacting you to inform you that our Microsoft Account Review Team identified
some unusual errors in your Microsoft account profile. This may be due to the following
Using a shared computer to access your Microsoft Outlook account.
Logging in your Microsoft Outlook account from blacklisted IP
Not logging off your Microsoft Outlook account after usage.
In order to safeguard your account, we require that you confirm your Outlook Account
Access the following link to complete the verification of your Outlook Account.
Unblock Verify Now

Thanks,
Microsoft ID Customer Support
Copyright 2016 Inc.
All rights reserved. Terms of Service,
Microsoft Account Team."

Delete


by an anonymous user from: Carrollton, Texas, United States

I got it and stupidly fell for it. The PRIMARY reason for this potential tragedy is that Microsoft has conditioned me to respond to such requests. From time to time, Microsoft decides to force password changes even though I will swear to God himself that my own account is blameless and not in need of action.

It burns a *lot* of time and causes errors and sometimes extended expensive temporary loss of access when they do that. It happens so often, for NO REASONABLE CAUSE, that finally this time I shot myself in the foot when an imposter came calling.

This dumbing down, sheep treatment by Microsoft has [somewhat] worn me into a dumb sheep. Their mantra of Deproductivity has claimed, for a moment anyway, one more victim.

Microsoft designers in many, many, many technical regards the most technologically inept designers in history, and with the power that they yield, their ineptness inflicts untold damage on the world as they damage productivity.

Before Microsoft, the U.S. ascended to superiority in all aspects of science and technology. Since Microsoft, that superiority has partially crumbled. Microsoft is a huge factor in that. Don't be fooled by clueless fanboy journalism. They are to a huge degree self-deluded imbeciles.

I wish the Justice Department would quit jerking off and go ahead and bust their monopoly!

Delete


by info

Here is another scam:

"From: Outlook©
Sent: ‎Saturday‎, ‎September‎ ‎24‎, ‎2016 ‎6‎:‎25‎ ‎AM

Unusual Activity Detected

We detected something unusual about a recent activity to your microsoft e-mail account. To help keep you safe, we required an extra security challenge. You will need to verify your microsoft email account below to confirm that the recent activity was yours and to regain access and enjoy our unlimited service. Failure to verify will lead to permanent suspension of your account

Verify Now
What happened?
Using a shared computer to access your account.

Logging in your microsoft account from blacklisted IP.

Not logging off your account after usage.
Thanks for using your Microsoft account to bring the people who matter most together in one place. You can change your connection settings anytime and find more ways to connect at https://profile.live.com/services.

See you online,
The Microsoft team"

Delete


by info

Here is another phishing message:

"From: AbdulMougheeth Halfawi
Sent: Monday, September 19, 2016 9:19 PM
Subject: Microsoft account unusual sign-in activity

Welcome to new Outlook.com

Due to the ongoing update in our system/server you are required to re-verify your account within 24 hours to enable us register your
country/device in our database. Failure to re-verify your account will lead to account de-activation and you will no longer have access
to many of the features for improved Conversations, contacts and attachments.

Take a minute to re-verify your account for a faster, safer and full-featured Microsoft Outlook experience.
Your security tight is our concern!
Click here to re-verify your account

Thank you for using Microsoft products and services."

Delete


by an anonymous user from: Cardiff, Wales, United Kingdom

I have had a similar email this morning about an old Microsoft account and email that I no longer use, plus I revived the same message via SMS. I didn't click any links as it looked phishy...

Delete


waiting