Scam Email Allegedly From Microsoft

LGLDSR73-6492 1,480 Reputation points
2026-09-03T22:18:52.1333333+00:00

I received an email allegedly from MS saying my Subscription has expired. The only subscription I have is for MS 365 Personal that expires April 6, 2027:

1 actual subscription

Email telling me a Subscription has expired:1 Subscription expired

This was at the top of the email:

1 Account billing

NOTE THE 'FROM' FIELD:
1 a from

Portion of email header at bottom.

I do not know if this is legit of not. That said and given the Senders email address, I would say it is definitely not legit. As I said, I only have one Subscription with MS, and that is MS 365 Personal which I will not be renewing next year.

Thank you,

LGLDSR73 EMAIL HEADER, IN PART:

Received: from LV2PR01MB433587.prod.exchangelabs.com (2603:10b6:408:3aa::8) by MW4PR01MB6353.prod.exchangelabs.com with HTTPS; Thu, 3 Sep 2026 21:48:37 +0000 Received: from MW4P222CA0012.NAMP222.PROD.OUTLOOK.COM (2603:10b6:303:114::17) by LV2PR01MB433587.prod.exchangelabs.com (2603:10b6:408:3aa::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Thu, 3 Sep 2026 21:48:36 +0000 Received: from MWH0EPF000C618E.namprd02.prod.outlook.com (2603:10b6:303:114:cafe::84) by MW4P222CA0012.outlook.office365.com (2603:10b6:303:114::17) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.11 via Frontend Transport; Thu, 3 Sep 2026 21:48:35 +0000 Authentication-Results: spf=pass (sender IP is 209.85.222.171) smtp.mailfrom=notify.tangcifu.net; dkim=pass (signature was verified) header.d=notify.tangcifu.net;dmarc=bestguesspass action=none header.from=notify.tangcifu.net;compauth=pass reason=109 Received-SPF: Pass (protection.outlook.com: domain of notify.tangcifu.net designates 209.85.222.171 as permitted sender) receiver=protection.outlook.com; client-ip=209.85.222.171; helo=mail-qk1-f171.google.com; pr=C Received: from mail-qk1-f171.google.com (209.85.222.171) by MWH0EPF000C618E.mail.protection.outlook.com (10.167.249.100) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Thu, 3 Sep 2026 21:48:35 +0000 X-IncomingTopHeaderMarker: OriginalChecksum:EA4981E42E629BD7694E2AF76784A5334A334342331997A4CBD4E9DAE1AE3173;UpperCasedChecksum:10C5A1AAE9EA13A6296BB061CC4A5AE6A1C08FB13391A0A6B8286884849C447D;SizeAsReceived:6034;Count:55 Received: by mail-qk1-f171.google.com with SMTP id af79cd13be357-92edb12cdf2so24645485a.3 for ******@outlook.com; Thu, 03 Sep 2026 14:48:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=notify.tangcifu.net; s=google; t=1788472115; x=1789076915; darn=outlook.com; h=mime-version:content-type:disposition-notification-to:date :message-id:cc:to:subject:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=/3/dRcyKlfJ0F1bb9R3HAIb5Zw/B/7fVghrAITh2n6Y=; b=HfjgnZPuEe8f0dvBkorajuhTJIgbX853LKGagigDLha4BXKCZS7OSltdQW+UxSHLu8 X2l6zbj9z4hmaoNSx/vuf7tyT9v8QrxYB9jUfW56naVL7/Kr8i5UBEOoZDjuQ2gLZoJ4 qIXbd7Hno1Tzn5bKjH8qEDHKc4FGvtCavvpTxaeTolUqukAa5nWwi41FigpMUaNS7loB z4Vo6eYCd4XydHNrwriPGKfYbqG9YNM9EBNiAT6WPOswI6NvwYA+6L81br9EziGgQdtF Ef4zGAHpcjWGWxeyfMHUvGtEkQ1pU5QAn3eQKMPK/AFzvKU0EN6IPoh5QbjX6CFpEW1I X7Pw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788472115; x=1789076915; h=mime-version:content-type:disposition-notification-to:date :message-id:cc:to:subject:from:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to:content-type; bh=/3/dRcyKlfJ0F1bb9R3HAIb5Zw/B/7fVghrAITh2n6Y=; b=KnGYH+CO0tVKYVlXun4Y8B4lnCkH79xC0zVeOaOpFxjaLc+uFofvogxA3Fj8HMJqj3 e+Zig1MmQ4qOD2GkhQ6AGpUog5yWzHeVjQRjhT0xa4Pvsgfl36/58939ZC5ao9q4QIqK YzvKn9ohXJUhqo0Sigs75bKdO6vqS4Rh22VzHCD3mtGIz52WYpgqsIab3GTs8sEsdvaC bgZCmIpWaH6Kh5NmjeADwip8s0iEgZZI11CzErdQixnxKvDmMCWVm1+Z45R7vxyXxJ2y K6qIwj2zQ4wNzSVc0GvNFvlRje/Aw+sCRv68Yb9GS+9e8HLD8rlBBTYXFDw9A4o515eh 4IDw== X-Forwarded-Encrypted: i=1; AKwUvBxbdC1b05iGcbD5YoN5uUhLn4lsGIMsjPZ2k/PSSZlPz1jDSgz+tssRWRNtNiaeeyjGDetMIdKxQw==@outlook.com X-Gm-Message-State: AFuF++kKxMMUjnYL8AO4mDhAfltuIN4khazv5yR1bJd1d8txZeZJWfRh xvtBbnm8L6cj8yk4U2Sd4L6fepxJ5nTlsHiwTu5USeeWBEIAzPoZhYgyCuWo9/mIZXOR X-Gm-Gg: AYBFou3MH7gIQPd4EbADABcaVPawmDGAP8C/hQ3A89Dc+bHYzKCMH30pUGGGFaBoe8S 3OasNxxAK5m2o3ml38PJpqmeOGMTxXtYTJAqhxp/S7fvrh3gvBh2FhfMkhcwMeyVeMvc9hrtq4L

Microsoft 365 and Office | Subscription, account, billing | Other | Other
0 comments
Answer accepted by question author

AI answer

2026-09-03T22:19:08.4733333+00:00

This email is not legitimate.

The strongest indicator is the sender domain in the header and From field: notify.tangcifu.net. Microsoft support emails are expected to come from Microsoft domains such as microsoft.com, microsoftsupport.com, mail.support.microsoft.com, office365support.com, or techsupport.microsoft.com. For Microsoft account team notifications, the trusted domain is @accountprotection.microsoft.com.

Other red flags in the message shown:

  1. The subscription status in the account screenshot shows Microsoft 365 Personal expires on April 6, 2027, which conflicts with the email claim that the subscription expired on September 3, 2026.
  2. The message uses urgency around billing and asks for a payment update, which is a common phishing tactic.
  3. The header shows authentication for notify.tangcifu.net, not for a Microsoft domain. Passing SPF or DKIM only proves the message was authorized by that domain, not that it came from Microsoft.
  4. Outlook guidance says to be cautious when the sender identity does not match what appears in the message and when domains are mismatched.

Recommended action:

  1. Do not click the Update payment method button.
  2. Do not reply to the message or open any attachments.
  3. Mark it as phishing or junk in Outlook.
  4. If reassurance is needed, check the subscription only by signing in directly to the Microsoft account subscription page already used, not through the email.
  5. If the message claims to be from Microsoft support, compare the sender domain against the documented Microsoft support domains.

Based on the sender domain and the mismatch with the actual subscription expiration date, this is a phishing email.

References:

AI-generated content may be incorrect. Read our transparency notes for more information.

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Oldest
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.