Microsoft "unusual sign-in" email scam
These emails say someone signed in to your Microsoft or Outlook account from another country and that it will be suspended unless you verify your password through a link.
How this scam works
Fear that someone is in your account makes you log in fast. The fake page captures your password.
Common versions of the message
- A sign-in from a scary location
- An account suspension deadline
- A link to verify your password
What the message looks like
Email from Microsoft account team <no-reply@ms-account-alerts.top>: Unusual sign-in activity
We detected an unusual sign-in to your Microsoft account from Russia. If this was not you, your account will be suspended within 24 hours. Verify your password now to secure your account: http://ms-account-alerts.top/secure
Fictional example based on common, publicly reported scam patterns.
The red flags
- 1
Scary location: “unusual sign-in to your Microsoft account from Russia”
Made to make you panic
A scary location is chosen to make you panic.
- 2
Rushed deadline: “will be suspended within 24 hours”
So you click before you check
The deadline is pressure so you do not check.
- 3
Asks for your password: “Verify your password now”
The fake page steals it
Typing your password into a page from an email is how it gets stolen.
- 4
Not Microsoft: “ms-account-alerts.top”
Real Microsoft links end in microsoft.com or live.com
Real Microsoft links end in microsoft.com or live.com.
What to do
- Do not click the link.
- Check your recent activity by typing account.microsoft.com yourself.
- Delete the email.
If you already replied, clicked, or paid
- If you entered your password, change it right away at account.microsoft.com.
- Turn on two-step verification.
- Change the password anywhere else you reused it.
Got a message like this?
Paste it into TrustShield's free checker to see the warning signs in seconds. No sign-up needed to try it.