Microsoft account unusual sign-in activity email, -----> Is this phishing?

I got this this morning in my junk folder and when hovering over email address there is none. I got similar ones on 2/13 from Spain and one on 2/15 from Nigeria. NO VISIBLE SENDER EMAILS WHEN HOVERING OVER SENDER'S EMAIL . What is the email address from Microsoft when these unusual activity emails are real and valid? Nothing looks out of the norm when checking my Microsoft activity.

Security alert <no-reply@microsoft.com> Sun 3/20/2022 5:58 PM **

To:

• You

I don't know what the legitimate email address is from Microsoft for these notifications. I can say that my father-in-law has been experiencing the same issue with a lot of these mails and they are going into his Junk folder. He has been checking for actual unusual activity as well and finding none. (Yay.) The most recent of these suspicious emails have no sender or reply address (which suggests it could be from the mail system) rather than some address that looks phishy. However, the big clue that remains is the URL of the "Report The User" button. In at least one of the emails the URL mailto address was "googlemail.com", which is obvious attempt to be close to "gmail.com".

It doesn't hurt to check accounts for suspicious activity during these times, but the mails with a questionable URL are phishing.

Good luck everyone!

Hi dBelcourt,

Thank you for posting your concern here at the Microsoft Community Forum.

We see that you received a notification that there was an unusual activity on your account. Yes, that email was from our system, and it is a legitimate Microsoft Account notification.

For your account's safety and security, every Microsoft Account has a feature that can detect if your account is being accessed outside of your usual sign in location. If you do not recognize the sign in attempt, we highly recommend that you change your password immediately. This will protect your account from being hacked.

In addition, we recommend that you consider adding an extra layer of security to your account. Here's how you can protect your Microsoft Account: How to help keep your Microsoft account safe and secure.

If you use a VPN connection, the system will detect that and it will continue to notify you of the unusual activity. If this is the case, you'll need to add your device as trusted to make sure that you won't be locked out, and keep all your security information (phone number and alternate email address) updated.

Let us know if you have additional queries.

I had the same email the other day saying someone in India signed into my account.

I read the above advise, and clicked the It was not me link. Well and good, but the a reply email that popped had a Google address for my response. ******@gmail.com

I'm concerned. Why would Microsoft use Gmail to receive it's response? Yes, I have a Chromebook and alternate using both Win10 and Chrome browsers on my Windows laptop, but it Still seems like Phishing to me. I'm not sending this until I get some clarification, and taking it out of my SPAM folder and putting into my Inbox so it won't disappear in another 7 days.
Thank you to anyone that can give me some peace of mind
Donna

I read the above advise, and clicked the It was not me link. Well and good, but the a reply email that popped had a Google address for my response. *** Email address is removed for privacy ***

I'm concerned. Why would Microsoft use Gmail to receive it's response? Yes, I have a Chromebook and alternate using both Win10 and Chrome browsers on my Windows laptop, but it Still seems like Phishing to me. I'm not sending this until I get some clarification, and taking it out of my SPAM folder and putting into my Inbox so it won't disappear in another 7 days.
Thank you to anyone that can give me some peace of mind
Donna

Donna, those emails are indeed phishing. Microsoft would not use a Google address. The actual address was removed from your post, but I suspect it said "googlemail.com" and not even "gmail.com". Another sign it is bogus. You should re-mark that mail as spam / delete it.

It would not surprise me if the secondary aim of those mails were to get people to stop paying attention to any actual alerts that come through by just overloading us.

If you are ever concerned about activity, see https://account.live.com/Activity. You can learn more about the Recent Activity page at What is the Recent activity page? (microsoft.com)