Weird email from Microsoft

El Mucho

My wife has received two emails in the past month from account-security-noreply@account.microsoft.com

The first time she got the email she changed all her passwords etc. Just today she received another email from the same address saying someone had accessed her gmail account in Russia.

I looked online and I can't find any definitive information on whether this is a real email from Microsoft or some weird scam.

The body of the email contains the following text:

Microsoft account
Unusual sign-in activity
We detected something unusual about a recent sign-in to the Microsoft account *********@gmail.com. To help keep you safe, we required an extra security challenge.
Sign-in details:
Country/region: Russia
IP address: 195.74.89.173
Date: 5/16/2014 12:51 PM (PST)
If this was you, then you can safely ignore this email.
If you're not sure this was you, a malicious user might have your password. Please review your recent activity and we'll help you take corrective action.
Review recent activity
To opt out or change where you receive security notifications, click here.
Thanks,
The Microsoft account team

The strangest part of this is that I'm almost certain she doesn't have her gmail account linked with anything Microsoft related.

Anyway, any insight would be much appreciated.

Enc

It is almost certainly a scam, with the "click here" being a keylogger or some such.

Edit: That said, you can always check either with Microsoft or Google by calling them directly from contact info on a known website to verify.

Hevach

Sounds like phishing. Right click on links and copy the address, then paste them into notepad. They'll probably be ridiculously obfuscated URLs, but they won't be anything in any Microsoft or Google domain. They'll look like "domain-password.recoversecure.iso.3g8ad9.microsoft.com.rt.tk" or such silliness.

Because it's effectively free to send them (they're usually generated by a botnet, not any kind of bandwidth the scammer is paying for), it doesn't make sense *not* to plug every address in your database into every form letter you can mock up, even if the person you're mailing doesn't have that kind of account or even if it doesn't actually make sense - you're preying on the stupid, after all.

Changing all related passwords is never a bad idea. You can try to log into a known Microsoft site using the gmail address. If the account exists you'd be able to change its password.

Inquisitor77

It's definitely a phishing email. Flag it as spam in Gmail, and delete it.

In the future, if you do receive notices like this, never click any links provided or download any attachments. Just go to the website directly in your browser, log in there, and verify if there actually is a problem.

Iceman.USAF

You can also check your gmail log in locations. Log into gmail, scroll to the bottom and on the right side in fine print is the word "Details". It'll show all the locations you have accessed it from.

El Mucho

Thanks for the replies. I figured it out.

The email was legit. My wife used her gmail email address as her login for Windows 8 and had a ridiculously poor password. So there were attempts to access her windows live account. Luckily the the live account had a two step authentication process.

Anyway, I logged in and changed her password.

This thread can be closed.