# Is this email legit or a scam?

**URL:** <https://boards.straightdope.com/t/is-this-email-legit-or-a-scam/809965>\
**Category:** In My Humble Opinion\
**Created:** [March 3, 2018, 3:40pm UTC](https://boards.straightdope.com/t/is-this-email-legit-or-a-scam/809965 "2018-03-03T15:40:33Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Spiderman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/spiderman/32/230_2.png) [@Spiderman](https://boards.straightdope.com/u/Spiderman)\
**Post date:** [March 3, 2018, 3:40pm UTC](https://boards.straightdope.com/t/is-this-email-legit-or-a-scam/809965/1 "2018-03-03T15:40:33Z")

</div>

I’ve gotten a bunch of emails, supposedly from Microsquash. Everything I know screams don’t click on a link in an unsolicited email, ever; however, “they” have sent me a bunch over a couple of weeks & the address kinda-sorta looks legit & is the same from address email to email. What’s your take, dopers?  
P.S. there’s nothing in my sent box that I didn’t send & there haven’t been any questionable ones to my inbox either (ie. we reset your password for you). I don’t use this account for anything other than email, no calendar, no one drive, etc. so even if it _was_ compromised, I wouldn’t lose my world.

From address: account-security-noreply @ [accountprotection.microsoft.com](http://accountprotection.microsoft.com) \<– I altered is slightly by breaking the link because otherwise vBulliten tries to insert email tags around it.

_Text: Verify your account  
We detected something unusual about a recent sign-in for the Microsoft account xxx_\*\*\*@hotmail.com. For example, you might be signing in from a new location, device, or app.  
To help keep you safe, we’ve blocked access to your inbox, contacts list, and calendar for that sign-in. Please review your recent activity and we’ll help you take corrective action. To regain access, you’ll need to confirm that the recent activity was yours.  
Review recent activity  
Thanks,  
The Microsoft account team\*  
_One_ device forced me to log in again, but none of the other 4 devices I check this email from were blocked at any point. Yes, password has been updated; should I continue to ignore them or do you think I should click on the link because I’ve only ever gotten that message once (in gmail or DropBox, etc), immediately after logging on from a new device, not repeatedly & for weeks.

---

<div class="post-metadata">

**Author:** ![simster](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/simster/32/1047_2.png) [@simster](https://boards.straightdope.com/u/simster)\
**Post date:** [March 3, 2018, 3:53pm UTC](https://boards.straightdope.com/t/is-this-email-legit-or-a-scam/809965/2 "2018-03-03T15:53:37Z")

</div>

assume scam - use you’re normal method for logging in.

never click on a link in any mail to ‘verify your account’ - that you did not directly expect ~99% of the time, its phishing.

---

<div class="post-metadata">

**Author:** ![running\_coach](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/running_coach/32/15836_2.png) [@running\_coach](https://boards.straightdope.com/u/running_coach)\
**Post date:** [March 3, 2018, 4:13pm UTC](https://boards.straightdope.com/t/is-this-email-legit-or-a-scam/809965/3 "2018-03-03T16:13:02Z")

</div>

> [@simster](#):
>
> assume scam - use you’re normal method for logging in.
> 
> never click on a link in any mail to ‘verify your account’ - that you did not directly expect ~ **99% of the time** , its phishing.

You left off the decimal and a few 9s.

---

<div class="post-metadata">

**Author:** ![Morgenstern](https://avatars.discourse-cdn.com/v4/letter/m/f9ae1b/32.png) [@Morgenstern](https://boards.straightdope.com/u/Morgenstern)\
**Post date:** [March 3, 2018, 4:15pm UTC](https://boards.straightdope.com/t/is-this-email-legit-or-a-scam/809965/4 "2018-03-03T16:15:41Z")

</div>

Change password day for you I’m afraid. Just to be safe.

---

<div class="post-metadata">

**Author:** ![Spiderman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/spiderman/32/230_2.png) [@Spiderman](https://boards.straightdope.com/u/Spiderman)\
**Post date:** [March 3, 2018, 4:21pm UTC](https://boards.straightdope.com/t/is-this-email-legit-or-a-scam/809965/5 "2018-03-03T16:21:50Z")

</div>

> [@Morgenstern](#):
>
> Change password day for you I’m afraid. Just to be safe.

> [@Spiderman](#):
>
> Yes, password has been updated;

Beat you to it.  
Clearly my BS meter was pinging, you’re all just confirming that.

---

<div class="post-metadata">

**Author:** ![Qadgop\_the\_Mercotan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/qadgop_the_mercotan/32/83_2.png) [@Qadgop\_the\_Mercotan](https://boards.straightdope.com/u/Qadgop_the_Mercotan)\
**Post date:** [March 3, 2018, 4:28pm UTC](https://boards.straightdope.com/t/is-this-email-legit-or-a-scam/809965/6 "2018-03-03T16:28:29Z")

</div>

> [@Spiderman](#):
>
> Clearly my BS meter was pinging, you’re all just confirming that.

Your BS meter shouldn’t ping, it should be blaring so loud you can’t perceive anything else. 😃

---

<div class="post-metadata">

**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\
**Post date:** [March 3, 2018, 4:35pm UTC](https://boards.straightdope.com/t/is-this-email-legit-or-a-scam/809965/7 "2018-03-03T16:35:12Z")

</div>

You might as well also dance in a counterclockwise circle and chant “bloody mary” three times, too, just to be safe. That’s about as relevant as changing your password would be.

Did you sign in to your account from a new device, just a few minutes before when that e-mail was sent? If so, then it’s probably legitimate. But don’t click on any links in the e-mail, anyway: Just log in the way you usually do.

---

<div class="post-metadata">

**Author:** ![Voyager](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/voyager/32/133_2.png) [@Voyager](https://boards.straightdope.com/u/Voyager)\
**Post date:** [March 3, 2018, 6:25pm UTC](https://boards.straightdope.com/t/is-this-email-legit-or-a-scam/809965/8 "2018-03-03T18:25:28Z")

</div>

Question - was this mail sent to the email account that was supposedly blacked? If so, how do they expect you to see it?

First thing to do is to expand the email header to see where this was really coming from. If you choose to update your password, see if you can turn on 2 factor authentication. Kind of a pain at times, but much safer.

---

<div class="post-metadata">

**Author:** ![Projammer](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/projammer/32/559_2.png) [@Projammer](https://boards.straightdope.com/u/Projammer)\
**Post date:** [March 3, 2018, 8:40pm UTC](https://boards.straightdope.com/t/is-this-email-legit-or-a-scam/809965/9 "2018-03-03T20:40:23Z")

</div>

Hotmail is the only service that alerts when I’m traveling because I’m logging in from a different locale so they may be legit.

Log into your account normally from a computer and check the notifications. Should be a bell shaped icon in the top right corner. Legitimate warnings will be echoed there.

---

<div class="post-metadata">

**Author:** ![Dewey\_Finn](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dewey_finn/32/4222_2.png) [@Dewey\_Finn](https://boards.straightdope.com/u/Dewey_Finn)\
**Post date:** [March 3, 2018, 8:48pm UTC](https://boards.straightdope.com/t/is-this-email-legit-or-a-scam/809965/10 "2018-03-03T20:48:26Z")

</div>

I’ve gotten alerts from Gmail, Citibank, Vanguard and other companies and services I use when I login from a new computer, or the IP has changed. For instance, here is a message in my Gmail account, “Your Google Account was just signed in to from a new Windows device. You’re getting this email to make sure it was you.” Sometimes, they will send a confirmation code to me by email, text or telephone (i.e., two-factor authentication).

---

<div class="post-metadata">

**Author:** ![Spiderman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/spiderman/32/230_2.png) [@Spiderman](https://boards.straightdope.com/u/Spiderman)\
**Post date:** [March 4, 2018, 1:29am UTC](https://boards.straightdope.com/t/is-this-email-legit-or-a-scam/809965/11 "2018-03-04T01:29:28Z")

</div>

> [@Chronos](#):
>
> You might as well also dance in a counterclockwise circle and chant “bloody mary” three times, too, just to be safe. That’s about as relevant as changing your password would be.
> 
> Did you sign in to your account from a new device, just a few minutes before when that e-mail was sent? If so, then it’s probably legitimate. But don’t click on any links in the e-mail, anyway: Just log in the way you usually do.

No, but one of my devices was force logged out & I had to log back in on that one, so I thought that might be the item. Don’t know why it got logged out, though.

Will check the headers further when I get back to a real computer (I’m in a hotel right now).

---

<div class="post-metadata">

**Author:** ![Dewey\_Finn](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dewey_finn/32/4222_2.png) [@Dewey\_Finn](https://boards.straightdope.com/u/Dewey_Finn)\
**Post date:** [March 4, 2018, 3:18am UTC](https://boards.straightdope.com/t/is-this-email-legit-or-a-scam/809965/12 "2018-03-04T03:18:35Z")

</div>

You’re in a hotel? That could well explain why the alarms went off. They see your account being used from an unfamiliar location.

---

<div class="post-metadata">

**Author:** ![Spiderman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/spiderman/32/230_2.png) [@Spiderman](https://boards.straightdope.com/u/Spiderman)\
**Post date:** [March 4, 2018, 3:42am UTC](https://boards.straightdope.com/t/is-this-email-legit-or-a-scam/809965/13 "2018-03-04T03:42:47Z")

</div>

> [@Dewey\_Finn](#):
>
> You’re in a hotel? That could well explain why the alarms went off. They see your account being used from an unfamiliar location.

No, I’m in a hotel NOW, they’ve sent me at least 9 emails over the past few weeks, all from the same address in the OP. My experience is spammers don’t use the same address over & over & over again & given it looks _kinda_ legit, I was wondering if it really is real.

---

<div class="post-metadata">

**Author:** ![ftg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ftg/32/2801_2.png) [@ftg](https://boards.straightdope.com/u/ftg)\
**Post date:** [March 4, 2018, 1:26pm UTC](https://boards.straightdope.com/t/is-this-email-legit-or-a-scam/809965/14 "2018-03-04T13:26:00Z")

</div>

Note that by using alternate alphabets someone can obscure a link so that it looks legitimate. E.g., that “o” in “hotmail” might actually be a symbol from another alphabet that looks like an “o” and thus points to the domain that is owned by the scammer which simulates a hotmail login page.

Don’t click on links in email! Not ever. Go to the site in a separate page where you type it in. (At least the domain name part.)

---

<div class="post-metadata">

**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\
**Post date:** [March 4, 2018, 2:17pm UTC](https://boards.straightdope.com/t/is-this-email-legit-or-a-scam/809965/15 "2018-03-04T14:17:53Z")

</div>

All credit card companies and banks, if they have any sense at all, will address you in the message by actual name, not the email address, and not “Dear Accountholder.” So if your name doesn’t appear, you know it’s a scam. It’s a cold solicitation.

However, if your real name _does_ appear, that doesn’t mean it is legitimate, it just means they have more info about you than just your email address; it’s a hot solicitation.

Worst of all is when banks hire emailing services to send out ads. They may or may not use your name, but the kicker is the address of the sending party, _which looks like a phish because it didn’t come from the bank, but a mailing service._ They are foolishly training customers to click on something that looks good for that reason alone. Bad practice.

---

<div class="post-metadata">

**Author:** ![Czarcasm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/czarcasm/32/4050_2.png) [@Czarcasm](https://boards.straightdope.com/u/Czarcasm)\
**Post date:** [March 4, 2018, 4:18pm UTC](https://boards.straightdope.com/t/is-this-email-legit-or-a-scam/809965/16 "2018-03-04T16:18:34Z")

</div>

What exactly was the address used by them?

---

<div class="post-metadata">

**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\
**Post date:** [March 4, 2018, 5:16pm UTC](https://boards.straightdope.com/t/is-this-email-legit-or-a-scam/809965/17 "2018-03-04T17:16:32Z")

</div>

> [@Czarcasm](#):
>
> What exactly was the address used by them?

To whom are you addressing this question?

---

<div class="post-metadata">

**Author:** ![Voyager](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/voyager/32/133_2.png) [@Voyager](https://boards.straightdope.com/u/Voyager)\
**Post date:** [March 4, 2018, 6:34pm UTC](https://boards.straightdope.com/t/is-this-email-legit-or-a-scam/809965/18 "2018-03-04T18:34:33Z")

</div>

> [@Dewey\_Finn](#):
>
> You’re in a hotel? That could well explain why the alarms went off. They see your account being used from an unfamiliar location.

I’ve never had a problem from a hotel when using my laptop. If you log in from a different device, both Yahoo and Gmail sent a code to my smartphone to prove I’m me.  
So the question is whether **Spiderman** is on his own phone/computer or a hotel business service one.

---

<div class="post-metadata">

**Author:** ![Riemann](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/riemann/32/3133_2.png) [@Riemann](https://boards.straightdope.com/u/Riemann)\
**Post date:** [March 4, 2018, 6:53pm UTC](https://boards.straightdope.com/t/is-this-email-legit-or-a-scam/809965/19 "2018-03-04T18:53:55Z")

</div>

> [@simster](#):
>
> never click on a link in any mail to ‘verify your account’ - that you did not directly expect ~99% of the time, its phishing.

> [@running\_coach](#):
>
> You left off the decimal and a few 9s.

This is not true. I very frequently get _bona fide_ emails asking me to log in via the handy link provided to do something or other. I’ve had them from my bank and other financial accounts, taking me to a page on which I’d enter critical security information.

Of course, I never use the links, and sometimes I send angry emails to their customer services department telling them they are fucking idiots. So long as idiot companies keep doing this, they are to blame for enabling phishing.

---

<div class="post-metadata">

**Author:** ![amaguri](https://avatars.discourse-cdn.com/v4/letter/a/49beb7/32.png) [@amaguri](https://boards.straightdope.com/u/amaguri)\
**Post date:** [March 5, 2018, 5:15pm UTC](https://boards.straightdope.com/t/is-this-email-legit-or-a-scam/809965/20 "2018-03-05T17:15:54Z")

</div>

In my experience, Microsoft absolutely sends these emails and regularly locks accounts when they think you’re accessing it from somewhere unusual (or from a new device.) It’s for a good cause I suppose but also fairly annoying for someone who travels often.

[Next page](https://boards.straightdope.com/t/is-this-email-legit-or-a-scam/809965.md?page=2)