How to tell if an email from Microsoft is a scam

Greetings!

This is Tin, I'll do my best to help. That's right to be cautious. Please do not click on any links or buttons in the email you have received.

The best thing to do is open your browser separately and go to https://account.microsoft.com/services, then sign in to your account and check if your subscription is active. If yes, kindly go to https://onedrive.live.com to check your Onedrive usage.

There you can confirm if you're really lacking space for your OneDrive.

To avoid scam or phishing emails:

Please check the Microsoft website below on how to protect yourself from scam

https://support.microsoft.com/en-us/office/protect-yourself-from-tech-support-scams

https://support.microsoft.com/en-us/security/protect-yourself-from-online-scams-and-attacks

Thanks,

Tin

I get that type of email every week - dozens of them. My account will be closed, my content will be deleted, etc. etc. They are all scams, which I'll explain below.

FIRST, I know for a fact that all my subscriptions are paid in full, and the amount stored in my accounts is well within the limits. I can easily confirm this at any time. That's how I know these messages are scams the minute I see them.

If you aren't sure what subscriptions you have, or whether they are paid up, or whether you are within the limits of your storage, you need to find out. In your case, you have never subscribed to a Microsoft 365 plan in the first place, so you know that this message is phony right out of the gate.

SECOND, for fun, I rest my mouse pointer (never click) on the name of the sender. That pops up a small window that shows you the sender's real address. That's the other way I know it's a scam as soon as I see it.

WHY DO YOU RECEIVE THEM? The sender has no idea who you are or whether your account is frozen or you've exceeded your storage. You are just one of thousands of email addresses that received the same spam. The sender wants to alarm you, so that you'll open the message and the sender will try to phish your account's username and password.

This points out another advantage of a passkey over a username/password combination. With a passkey, there is nothing you need to enter to be signed in to a website, so there's nothing that can be stolen from you (or forgotten.)

Agreeing with the two earlier answers: this is a scam, and the giveaway you already spotted (you've never had a Microsoft 365 subscription) is enough on its own. Since the question in your title is the general one, here's a checklist you can apply to any "your account has a problem" email, whether it claims to be from Microsoft, a bank, or a delivery company:

1. Read the actual sender address, not the display name. The display name is typed by the sender and can say anything. Expand or hover it to see the real address. Genuine Microsoft account notices come from a small set of Microsoft addresses ending in microsoft.com (for example ******@accountprotection.microsoft.com). Scam addresses use look-alikes, like an extra word, a swapped letter, a wrong ending, or a completely unrelated domain. When in doubt, skip straight to step 3. It works even when the address looks right.
2. Hover over every link and button before clicking. The true destination appears in the corner of your browser or in a tooltip. If an "Upgrade now" button doesn't lead to a microsoft.com address, stop right there.
3. Never resolve the "problem" through the email itself. As an earlier answer suggested, type account.microsoft.com into your browser yourself and sign in. Your account is the source of truth. If your storage were genuinely full you would see it there and inside OneDrive. If everything looks normal, the email was lying.
4. Notice the pressure pattern. A short deadline, a threat (freezing, deletion), and a payment button together are the classic scam shape. A tell specific to your case: genuine over-quota notices also offer the free fix, deleting some files to get back under the limit, while the scam version only pushes a payment. And even when a real service email does offer an upgrade, you never need its button. The same upgrade is available after signing in directly, so nothing is lost by ignoring buttons in email.
5. Never call a phone number printed in a suspicious email. If you need support, find the number on the company's real website.
6. Report and delete. In Outlook.com: select the message, then Report > Report phishing. That trains the filter and removes the email.
7. If you already clicked and entered your password: change it immediately at account.microsoft.com, sign out of all other sessions, turn on two-step verification, and review recent sign-in activity at account.live.com/activity.

For the specific emails you're getting: don't click, don't reply, report as phishing, delete. There is no real deletion pending. As long as you haven't entered your password or payment details anywhere those emails led, your storage and data are not at risk. The senders have no access to your account, all they have is your email address. (If you did enter anything, do step 7 now.)

Full disclosure: we build a free email scam checker. If you ever want a quick second opinion on a message like this, you can forward it to ******@OutlookDog.com (forwarding preserves the real sender address and true link destinations, which pasting loses) or paste the text at https://outlookdog.com/scam-check.html. Free, no signup, nothing stored. Treat it as a second opinion, not a final verdict. The sign-in-directly check in step 3 is still the gold standard.