An email says there was an unusual sign-in to your account.
The alert names a city you’ve never been to, or a device you don’t own, and gives you a button. Real services send alerts like this, and mostly they’re right to. So do the people imitating them.
Your account login is handled, and the message may be genuine. The boundary is that the message can’t vouch for itself. A logo, a layout, and a sender name are all things a copy can have. What you can check is your account, in a place you reach yourself.
Don’t use anything inside the email
The Federal Trade Commission’s advice on a message that claims a problem with your account is to contact the company using a phone number or website you know is real, not the information in the message. It also notes that a real company will not send a link to update your payment information.
So skip the button. Type the address of the service yourself, or open its app, and look there.
A Microsoft account
Microsoft Support says that genuine alerts about a personal Microsoft account come from the address account-security-noreply@accountprotection.microsoft.com. That helps with a mismatch, but it doesn’t prove a match, because the sender line on a message can be made to say anything. Treat the address as a reason to be suspicious when it’s wrong, never as the test when it’s right.
- Type account.microsoft.com into your browser and sign in.
- Open Security basics, then select Review activity to reach the Recent activity page.
- Find the sign-in the email describes. If you do and it isn’t yours, expand it and, under Unusual activity, select This wasn’t me. Under Recent activity, select Secure your account.
- Select Change password from Security basics if you think someone else has been in.
A work or school Microsoft 365 account
Sign in to My Account and choose Recent Activity. Expand each entry. Microsoft says location is estimated from the IP address and mobile networks can be badly off, so judge by the operating system, browser, and app as well as the city. Failed attempts may be someone guessing your password or a typo. A note reading “Additional verification failed, invalid code” means the password worked and the second step didn’t, which is the case where Microsoft tells you to change the password.
A Google account
Google’s security alerts show the device type, the time, and the location of the sign-in. Go to myaccount.google.com yourself and look at the Security issues found panel. If the activity isn’t yours, choose Secure account there, or No, secure account on the alert itself, and follow the prompts, which may include a password change.
What the result means
- The activity page shows the sign-in from the email, and it isn’t yours. Treat the account as in use by someone else: change the password from a trusted computer and look at forwarding, rules, and sign-in methods.
- It shows the sign-in, and it is yours. A trip, a new phone, or a VPN is the usual reason. Nothing more to do.
- It shows nothing like the email. The email gave you nothing to act on, and the page doesn’t confirm it. Ignore the buttons and delete or report it.
- Account support asks for your password or sends you a reset link. Microsoft’s page states that its support agents are not allowed to send password reset links or to access and change account details.
Report the fake ones
Forward a phishing email to reportphishing@apwg.org, which is the Anti-Phishing Working Group address the FTC names, and report it at ReportFraud.ftc.gov.
What this check can and can’t tell you
The activity pages list a subset of sign-in events. Not seeing the alert there doesn’t show that no one tried. A match tells you the service logged a sign-in. It doesn’t tell you what the person did once in.
When we look at this with you, we read the sign-in history and the account’s sign-in methods, rules, forwarding, and app permissions, and report what we found and what we didn’t, with dates.
Checking the account directly is how you learn whether the alert was true, and the email can’t answer that for itself.
Related
Sources
Talk to a person about what you noticed.
Call (•••) •••-••••
Kristina or Anne will answer. Available during US Eastern time.
While you wait: run the Reveal Scan on the computer you use for this.
Run the Reveal Scan on that computerThe Reveal Scan shows every problem it finds, with no charge and no credit card needed. Step-by-step instructions for fixing them are in the detailed report, which is paid, and you’ll see its price before you buy. It reads one Windows computer at a time and can’t see a mailbox.
Or ask for a call back. Tell us which computer or mailbox, and what you noticed.
Request a call back
Written by Craig Peterson, 35+ years successfully running IT and security for businesses. Last reviewed October 27, 2026.