Sample of the "Live.com Account Removal Request" Phishing Scam
From: The live.com Accounts <firstname.lastname@example.org>
Date: February 6, 2018 at 3:14:00 PM EST
Subject: Your Account is being Terminated Ticket ID [CASE:HTM396630983
This is to inform you that your request on: 2018-02-06 15-13-56 to remove your account from live.com Servers has been approved and will initiate in one hour from the exact time you open this message.
Ignore this message to continue with email removal or
If this deactivation was not requested by you Please reply to this mail directly without altering the subject.
The link in the phishing email message goes to a fake or phishing Live website, which will attempt to trick the potential victims into entering their usernames and passwords on it. If Live users attempt to sign into the phishing website with their usernames and passwords, it will be sent to the cybercriminals behind the email scam, who will use the information to hijack their accounts. The hijacked Live accounts will then be used by cybercriminals fraudulently.
Remember, if you receive email messages like these, please go directly to your email account instead of clicking on the links in the email messages. If there is anything wrong with your account, it will be shown to you after signing in. And, if you were tricked by one of these phishing scams, please change your password immediately before your Live account is hijacked. If your account has already been hijacked, click here for help regaining access to it.