A Real Microsoft Email Can Still Be a Trap

The Situation

I get these emails too, so here is a warning. Scammers have found a way to turn a real Microsoft security email against you.

The email comes from Microsoft's real security address, accountprotection.microsoft.com. Its link goes to Microsoft's real site, account.live.com. James reports it passes spam checks, which is why it looks so convincing.

The trap is the "remove my email address" link at the bottom. If it is your account and you click it, you unlink your own recovery email. That can let an attacker swap in their own email and take over the account. Other platforms may have the same weak spot.

AI now lets scammers run tricks like this at scale.

The safe habit is simple. Never click a link inside a security email you did not expect. Instead, type account.microsoft.com/security into your browser yourself.

For propane offices: show this to whoever handles billing and dispatch email. Make "type it in, don't click it" an office rule.

<small>Tip via James at InvestAnswers.</small>