Microsoft Account Security Alert: How to Tell If It Is Real
An email says there was an unusual sign-in to your Microsoft account. Check it without clicking: the real sender, the Recent activity page, and what to do next.
The message says someone signed in from an unfamiliar place. It might be Microsoft. It might be a copy. You can find out in under two minutes without touching a single link inside it.
Microsoft is the name most often borrowed by phishing. Check Point Research’s Q3 2026 Brand Phishing Ranking, reported on October 20, 2026, put Microsoft at 33% of tracked brand phishing attempts, up from 23% in Q2, with Apple and Google next at 8% each. Check Point’s report as covered in trade press does not single out security alerts as a lure; it mentions billing warnings and fake install commands. Still, an alert that says “your account is at risk” works on the same urgency, and it is a message people are used to receiving.
The two-minute check
- Look at the sender. Microsoft’s support article says legitimate alerts come from [email protected]. A different address is a reason to stop. A matching address is a good sign but not proof by itself, because sender names can be faked, so keep going.
- Open a fresh tab and type the address. Go to account.microsoft.com/security. Do not use the email’s link or a search ad.
- Select Review activity to reach the Recent activity page.
- Compare. Does the time, place and device match something you did? If the Unusual activity section is empty and nothing odd is in Recent activity, the email may not have been real, or the attempt may have been blocked.
What the Recent activity page shows, and what it doesn’t
According to Microsoft’s Recent activity article, the page shows sign-ins and other account events from the last 30 days, with when and where the account was used. Expanding an Unusual activity entry adds the IP address, a map, the device or operating system and the browser or app. It does not list everything; it lists significant events that could affect security. That means an alert you cannot match to a listed event is not automatically fake, and a quiet page does not prove the account was never targeted.
| What you see | Likely meaning | Next step |
|---|---|---|
| Sender matches, activity page shows a sign-in you don’t recognize | A real alert about real activity | On the Unusual activity entry select “This wasn’t me” and follow the prompts to change your password and update security info |
| Sender matches, activity page shows nothing odd | Possibly a blocked attempt, or a copy | Change nothing under pressure; consider changing your password anyway from the site you typed in |
| Sender does not match | Likely phishing | Do not click or reply. Delete or report it |
| The message asks for a security code or password in a reply | Not a normal alert | Stop. Never send a code to someone who contacts you |
| A caller or chat “agent” offers to send a reset link | Suspicious | Microsoft’s article says support agents cannot send password reset links |
If it was real and you don’t recognize the sign-in
Microsoft’s guidance in the unusual sign-in article is to select “Change password” on the Security basics page and create a strong password you do not share. If you can’t sign in, try resetting your password; if that fails, select “Forgot my password” and then “I think someone else is using my Microsoft account.” For items in the Recent activity section rather than Unusual activity, select “Secure your account,” which opens the security settings page where you can change your password, update security options and remove all trusted devices.
After you regain control, review the other places an attacker may have left a foothold: apps you authorized, devices still signed in and the recovery details. Our guides on revoking unexpected app access go through those.
If you already clicked the email
Clicking is not the same as handing over a password. Our page on clicking a suspicious link and entering nothing shows how to check. If you did type a password, change it from a fresh tab on the real site, and change it anywhere you reused it. If you entered a code someone sent, treat it as more urgent and read the device-code guide.
Make the next one boring
- Bookmark account.microsoft.com/security so you never need an email to get there.
- Add a second sign-in method and keep recovery details current.
- Learn the sender address above, and if a work account is involved, learn your IT team’s reporting route.
- In our read, a message sent to an address you never used for Microsoft is more likely bulk phishing than an alert about you.
Codes you did not ask for
Microsoft’s article says it may email or text you about an unusual sign-in attempt, may send alerts to your alternate contact methods, and may ask for a security code to confirm it was you. Read that last point carefully. A code that arrives when you did not start a sign-in is a sign that someone else typed your address. It is not something to forward, read out or type into a page you reached from a message. Ignore it, and if you want certainty, check Recent activity as above.
Work and school accounts
The steps above are for a personal Microsoft account. If the message arrived in a work or school mailbox, the account is run by your organization, so report it using your employer’s process instead of changing settings yourself. Our guide to what to report in the first hour explains what to include.
Why this brand, why now
When a brand is in a third of tracked phishing attempts, an alert that claims to be from it is statistically likely to be a copy of something you will see again. That is not a reason to distrust genuine messages; it is a reason to make one habit automatic: open the account page yourself, every time, and let the email be only a prompt to look.
A note on lookalike sign-in pages
If you ever do reach a sign-in page from a message, the address matters more than the design. Phishing pages are built to look right. Microsoft’s own advice, as quoted above, is to go to the Security basics page yourself, so you never have to judge a page that someone else built. A passkey, where a service offers one, is a second layer, but the habit of starting from your own bookmark does the same job for free.