How can I tell if my login attempt was a Captcha scam?

Based on the information available, the behavior described (being asked for the last four digits of the phone number, then seeing an unusual, game‑like “ring of images” CAPTCHA, and not receiving the SMS code) should be treated as suspicious.

Key points and what to do next:

1. Treat unexpected or unusual sign-in flows as potentially unsafe
   • Microsoft sign-in challenges can include verification codes and CAPTCHAs, but the context shows that Microsoft focuses on standard verification methods (SMS, email, Authenticator) and does not describe a ring-of-images, avatar‑style CAPTCHA.
   • If a sign-in screen or CAPTCHA looks very different from what is normally seen, assume it may be a phishing or scam page until proven otherwise.
2. Lack of SMS code is a red flag
   • When a legitimate Microsoft sign-in asks for the last digits of a phone number, a verification code is normally sent promptly unless there is a temporary block or delivery issue.
   • The context notes that Microsoft may temporarily block sending codes if there is unusual activity or too many repeated requests, but that does not normally tie to a complex, unfamiliar CAPTCHA.
3. How to verify whether the attempt was legitimate
   • Do not reuse the same sign-in link or screen from that attempt.
   • Instead, open a browser and manually go to the known Microsoft entry points (for example, by typing the address directly) and sign in from there.
   • If sign-in works normally there, and no unusual CAPTCHA appears, the earlier flow was likely not legitimate.
4. What to do if there is concern about compromise
   • Immediately sign in to the Microsoft account via a trusted path and:
     • Change the account password.
     • Review recent sign-in activity for unfamiliar locations or devices.
     • Ensure security info (phone numbers, email addresses) is correct and has not been changed.
   • Consider switching from SMS codes to the Microsoft Authenticator app for more reliable verification, as described in the referenced materials.
5. General guidance on suspicious behavior
   • The phishing guidance for Outlook emphasizes that deceptive prompts and pages are used to capture credentials. If something in the sign-in or verification process feels off, close it and re‑start from a known, trusted Microsoft site or app.
   • Never follow sign-in prompts that arrive via unexpected links, pop‑ups, or embedded webviews whose origin cannot be confirmed.

If similar prompts appear again, capture the exact URL (without clicking anything further) and then abandon the attempt and re‑authenticate only from a known Microsoft site or the official Outlook app.

References:

• Common problems with two-step verification for a work or school account
• Using Outlook mobile to sign in
• Phishing and suspicious behavior in Outlook
• Having problems getting text codes to confirm my account - Microsoft Q&A