I believe someone tried to access my account without my permission

The email is a legitimate Microsoft account security message indicating that someone entered the Gmail address as a Microsoft account username and requested a single-use security code. This happens in these common situations:

1. Someone is trying to access the Microsoft account
   • A person who knows or guessed the Gmail address tried to sign in to a Microsoft service (for example Outlook.com, Xbox, or another Microsoft site) and chose to receive a verification/single-use code.
   • Because the email address is configured or treated as a Microsoft account sign-in, Microsoft sent the code to that address.
   • Without the code, they cannot complete sign-in, so the account remains protected.
2. Someone mistyped their own email address
   • Another user may have accidentally entered the Gmail address instead of their own when trying to sign in or create an account.
   • Microsoft still sends the verification code to the entered address, even if it belongs to someone else.

What to do now

1. Do not use or share the code
   • Since the code was not requested, ignore it and do not enter it anywhere.
   • Do not reply to anyone asking for this code.
2. Confirm the email is from Microsoft
   • Security-related Microsoft account emails are sent from domains like @accountprotection.microsoft.com. Check the actual sender address and, if needed, view the message headers to confirm the source.
3. Check for unusual activity on the Microsoft account
   • Go to the Security basics page and select Review activity to open the Recent activity page.
   • Review sign-ins and security events. If any activity is clearly not yours, mark it as such (for example, This wasn’t me or Secure your account, depending on where it appears).
4. Secure the account if any activity looks suspicious
   • From the Security basics page, select Change password and set a strong, unique password if the account is still in use.
   • If there is concern that someone else may have accessed the account or changed details, follow the recovery steps starting from Forgot my password and choose I think someone else is using my Microsoft account.
5. If you truly no longer use any Microsoft services
   • Still review Recent activity once to ensure there is no ongoing unauthorized use.
   • After confirming and securing the account, consider removing payment methods and updating or closing the account if appropriate, following the guidance from the security and account management pages.

Why Microsoft cannot identify “who” did it

Microsoft’s consumer-facing tools show when and where sign-in attempts occurred (time, location, device, IP-related info) on the Recent activity page, but they do not reveal the identity of the person who attempted access. The system only records sign-in attempts and security events tied to the account, not personal details of the person trying to sign in.

References:

• Can I trust email from the Microsoft account team?
• Troubleshoot Microsoft verification code issues
• What happens if there's an unusual sign-in to your account
• Check the recent sign-in activity for your Microsoft account