Microsoft Says Someone Changed My Profile Information

Hi Graham,

I understand your frustration with regards to the message you are receiving on your account regarding your profile information. 

As what my colleagues mentioned on this thread, the nature of this issue may contain personal or sensitive information of your account that can't be discussed in the forum. I suggest that you submit your concern to our Private Support via Secure Messaging so our Moderators can properly investigate the root cause why this issue occur. 

Your patience is highly appreciated.

Thank you!

I no longer receive the messages and my theory is that the different Microsoft services are not in sync, but that some recent change within Microsoft has made it so that the services try to get in sync.

For example if you have a hotmail account and your name is "John Doe", but you also have another Microsoft account that uses your hotmail accoun (MSDN, Forums, etc) where your name is just "John" or something else or any other information that is synced is different it causes issues.

For me I noticed that one of my accounts had my first name, but not my last name and when I logged into the site/application that the account is for I got the notification that my profile information changed.

These are all Microsoft services so I am hoping that the issue was just that the services talk to some central account service and they were conflicting when I used my account across different Microsoft services.

When I made sure to use the same information across accounts the messages stopped.  Or perhaps they have a bug where updating account info in one service doesn't correctly update it in the system causing this issue... who knows.

"It is a server-side issue that seems to be internal to Microsoft's network."

At the moment, there is no such information cascaded to us that would support this statement. It would be best if you contact our Microsoft Account Support for further assistance.

Should you have other questions, clarifications or any other concerns, please let us know and we will be happy to further assist you.

Regards,

Jeffrey

Jeffrey or other MS staff:

A bunch of us here are pretty certain there is one or more internal MS processes generating these alerts. Please see my posting of July 18 2014 for a report that is virtually 100% certainly a case of an internal process gone wrong. In brief:

1. In web browser, I followed a link which turned out to be someone else's skydrive. I never use skydrive myself (and almost never use Live), but apparently skydrive noticed a cookie and identified me, because...
2. Some while later, I got the infamous "Your profile has changed" scary email message.
3. When I dug into it, I saw that the Send time of scary email message was exactly the time that my browser history shows that I visited someone else's skydrive.

It is spectacularly unlikely that my account was hacked at the exact moment I happened to browse to skydrive.

So my conclusion is that your skydrive code calls your check cookie "do we know this visitor" code which calls your "has this user logged in recently" code, and if not, sets a flag to notify the user to do something, like maybe change password if it hasn't been done recently.

But unfortunately that's been implemented as "send user a scary message about account being hacked".

So there you have it: Almost 100% certainty that there's a problem on your server, and exact pointers where that problem is. Not to say that's the ONLY problem, but at least a start.

-- Graham 

(FWIW, a former MVP for Visio)

Your recommendation of two-step verification is spot-on and it doesn't need to be very intrusive if you designate your devices as trusted devices at the point when you enter the verification code.  If you use InPrivate Browsing, you'll always need to verify with a code, but most people don't, so the trusted device selection works well.

I think Microsoft's checking is completely automated and once the algorithms were programmed, the product team hasn't given it much thought since; a "set it and forget it" situation.  If you stay within the algorithm's proscribed boundaries, things work quite well, but if you inadvertently stray outside of them, you can wind up in security soup with catch-22s everywhere, where you need "A" to produce "B", but you need to use "B" to generate "A".

So, 4 or 5 moderators have chimed in and they still just don't get it. When I started this thread I was really concerned. But I checked my account thoroughly, changed my password, and activated two-step verification.* So I feel safe, despite having received this "alert" from Microsoft again.

The REAL issue has now become these BOGUS alerts from Microsoft sending everyone into unwarranted panic and NOT getting any real straight answers from moderators...just canned responses. It's apparent from reading through this thread that NOBODY has hacked their way into our accounts and NOTHING has changed in our information. BUT we're STILL getting these Microsoft alerts.

SteveM26 already got confirmation that nothing is wrong. ("...have a nice day!" HA!) So the important issue now is for Microsoft moderators and higher-ups to address the REAL problem: these bogus "alerts" and what triggering them. They need to take responsibility and fix this.

*I highly recommend everybody activate two-step verification. It means a little extra time getting into your account. But the security it offers more than makes up for the inconvenience.

pkb