Microsoft Says Someone Changed My Profile Information

Hi LynHartley,

Thank you for posting your concern here at the Microsoft Community. 

The nature of the issue may contain personal or sensitive information of your account that can't be discussed in the forum, I suggest that this be addressed through a secured environment for your privacy and ease of access to our moderator's reply. To get additional help from Microsoft team you can submit a ticket via this ***link***.

We are looking forward to your ticket submission.

Regards.

I really don't want to be rude here but every forum moderator response I've seen so far indicates a complete lack of understanding of the issue and a tick box answer. It isn't about personal information as such, it's about a process that is clearly going wrong within your system and as someone who has now changed his password 3 times because of these bogus messages (I'm not noting any changes in my profile), I'm getting a little frustrated with it. 

Get a grip, stop just cutting and pasting 'answer 27' into the forum and give us some straight answers!

Hi LynHartley,

Thank you for posting your concern here at the Microsoft Community. 

The nature of the issue may contain personal or sensitive information of your account that can't be discussed in the forum, I suggest that this be addressed through a secured environment for your privacy and ease of access to our moderator's reply. To get additional help from Microsoft team you can submit a ticket via this ***link***.

We are looking forward to your ticket submission.

Regards.

Weirdly, looks like Microsoft removed the offending IP address, which points to Microsoft BingBot of Microsoft Hosting in Redmond Washington.

So here it is again....  It is an IPV4 address

IP information '(Removed PII)'

In text, the number is (Removed PII).

Amazing lack of recognition and apparently some inability to communicate effectively by the Microsoft teams.

I have been following Steve's comments and agree with the conclusions.  However in my case, the errant messages are coming via text message and for I too, there has been no apparent profile data changed.  My guess is that the profile information being changed is some field that does not appear on the UI like "date last update by Bingbot".

I chased down the perpetrating IP address Removed PII and it is listed as Microsoft Bingbot from the organization = Microsoft Hosting.

Sadly, I still get these after setting up two-factor authentication and using the Request Approval app.  My conclusion is that using the best and most comprehensive account protection methods will not prevent these messages.

So, Steve, it is like the "little boy that cried wolf" wherein there is no actual threat from these sorts of conditions.  Yet they mask real profile attacks which ultimately makes the security less effective.

I would expect more of Microsoft.  In  terms of both interest in their customers and in terms of protection of their brand.  I guess Microsoft doesn't what we think of them.  And right now, I think they have security issues they don't care about.  

Not quite Ivy League.

It seems clear we are not going to get any assistance here in this forum.

I think with everything that is going on, it's now more important than ever to keep an eye on these notifications to check where they are coming from.

If you get one, don't ignore it.

First, check that it is a legitimate email.  It should contain a button / link "Review recent activity" that should link to https://account.live.com/activity (if it goes somewhere else don't click the link!).  If you're not sure, just go to the above link directly.

Sign in to your account and check the recent activity.  I'm in the UK, so what I see that is immediately odd is logins from the United States.  If you open any of these records it will show the IP address of the request along with other details.  If it was you, then it show your external IP address (which may be static or one that belongs to your ISP depending on how you are connected).  You can see your current external IP address easily by going to a site like http://whatsmyipaddress.org/

If the IP address isn't one you recognise then open up a Google search page and paste the IP address into the search box and search for it.  You will see a bunch of results that are mostly IP address information databases or lookup tools.

In my case, all of those USA ones are from Redmond, Washington - you know who's there, right?  All of the activity that is not mine belongs here, which are Microsoft servers.

HOWEVER, don't start ignoring these emails, because you could end up in a "boy who cried wolf" situation and may well miss one that actually IS a real breach and not one of these false alarms (as confirmed in my case by Microsoft).

DO turn on two-step / multifactor authentication on your account.  Go to https://account.live.com, login, go to Security & password, tap Turn on two-step verification.

I do hope Microsoft will address this issue.  I have tried contacting them directly as suggested.  The first response was basically "everything is fine - don't worry about it".  I pursued them for more detail but so far have been ignored with no further response.