Keep receiving a password reset email.

There are massive cyber attacks occurring at the moment and this may be part of that.   To get these emails the attackers either have a list with your email and phone number or, less likely, are brute force guessing the last digits of your phone number.   The attacks are probably running via bots installed on malware compromised devices.   I am not sure how they expect this attack to work unless it is intended as a denial of service attack or perhaps to instill fear and doubt as we are seeing in this threat.

For those freaking out that their Microsoft account has been compromised, if it was then you wouldn't be getting these emails as the attacker would have already taken it over.   It is more likely that another company you have given your email address and phone number has been hacked.   This detail is commonly asked for when online shopping for example.   I suspect this may be related to the Apollo data breach.

https://www.wired.com/story/apollo-breach-linkedin-salesforce-data/

The best way to avoid this situation is to use a dedicated login name for your Microsoft account rather than your default email address (I explained how to do this in an earlier post), so that the combination of your email address and phone number cannot be used to trigger a reset request.

We're aware that some customers may be receiving attempts to reset their passwords that they did not initiate and are investigating.

Make sure your security info is current and under your control. You can go to https://account.live.com/proofs/manage and make sure everything is current under "Security Info".

I have the same since mid may twice a day trying to access. this never happened before. the ips are from india Ukraine brazil salt lake city (which is not my location) ect . the  fun part is when I tried to add two step verification Microsoft never sent me the code to my second email so I cant have two way authentication activated . frustrating.

Serious Update.

Today I have finally had an authenticator access request pop up. This is a first!

So they have now either got the password correct (i checked on the haveibeenpwnd site its not listed, changed anyway) or have circumvented the password reset somehow.

The successful connection attempt was from France and I did select NO. What's worse is I have checked the log to find out more details and its not listed!?!

The notification I received was,

Log on authorisation request from "France" please select the number displayed on the device to authorise.

I clicked deny as it wasn't me and i'm certainly not on a French IP.

You must remember it’s not you that’s requesting the password change it’s either a spam or somebody else in the world that has your email address which I’m sure a lot of people do and a lot of sites do and they just keep keep keep on clicking forgot password and that’s why you keep getting that message to change your password