Microsoft Email - Spoof Or Not?

Vern1961 · 28 Jul 2017 at 08:22

Wasn't sure where to post this so mods feel free to re-locate as necessary.

Just had two emails purporting to be from MS advising of an attempt to log into my account from somewhere in Indonesia. Link in email inviting me to "review" my security details goes to

https://account.microsoft.com/activity

No way am I clicking on that but does it look genuine? The only MS "account" I have is on the Xbox which I set up when the wife couldn't recover her old account so there shouldn't be any financial details at risk.

Skillmister · 28 Jul 2017 at 08:33

Having just had similar emails I've realised in my stock email app there is no way of finding out what Web address a hyperlink is going to without clicking on it.. Quite poor.

That link you posted seems to redirect to login.live.com which I think is fine?

Clav · 28 Jul 2017 at 08:46

Just go and login to MS through a means you know is secure, ie not from a link in your email.

Efour · 28 Jul 2017 at 09:13

What clav says it's not rocket science.
Put 2 step mobile authentication on and you are pretty safe from external chancers.

I've had my Hotmail address for 20 years and it's a very easy format to try and brute force.

I get my fair share of attempts at logging in.

SexyGreyFox · 28 Jul 2017 at 09:31

This could happen if you have a VPN on.
I've had both Microsoft and Google sending me emails and I know it's me.

GravyMonster · 28 Jul 2017 at 09:34

I've had similar on our coroprate Azure account, although access in my case was from Vietnam. It seems genuine, as I did not click the link in the email, but went directly to the MS site where you can check the access logs and they tied in with what the email said.

If you remember to change your password every couple of months you should be fine.

mrk · 28 Jul 2017 at 09:37

Install the Microsoft Authenticator app and never worry about people hacking your account again. Any attempt to log into your account results in the app popping up on your phone asking to authorise it or not. You can also add other accounts like facebook/Google etc on the same authenticator app.

It works well, and everyone should be using some form of 2-step anyway.