Email From “Microsoft account team”

Topic

New Reply

(Moderator, please feel free to move this if there is a better forum for this.)

I have been receiving this email frequently, including nine times within two hours last night.  The email reads:

We received your request for a single-use code to use with your Microsoft account.

Your single-use code is: xxxxxxx

If you didn’t request this code, you can safely ignore this email. Someone else might have typed your email address by mistake.

Thanks,

The Microsoft account team

**********************************************’

I have Outlook 365 and the address that receives this email is my main email account and is on Outlook.com.  I do use Windows Defender for my security program.  This had been happening enough that I changed my Outlook password to something really long and really random, plus I have 2FA in force using an authenticator app.

Does anyone have any words of wisdom to share with me?

Thanks in advance.

Reply | Quote

Replies

Have you received that prompt since you changed the password?

Susan Bradley Patch Lady/Prudent patcher

1 user thanked author for this post.

John18

Reply | Quote

Hi Susan,

Oh yes on the password.  I had changed it 2-4 weeks ago.  But what is funny is that it stopped yesterday as soon as I turned my computer off last night and none arrived at all during the night.  But I received nine or so yesterday.  I also updated Windows 10 22H2 yesterday.

For some reason I still come back to Defender being a reason, but that can clearly be a bad idea.

Reply | Quote

Keep in mind there are two annoyingly confusing accounts – a Microsoft account as provided by your business or school (aka the business outlook) and a Microsoft personal account.

Also click on the “see your recent history” and see where it’s coming in from

https://support.microsoft.com/en-us/account-billing/check-the-recent-sign-in-activity-for-your-microsoft-account-5b3cfb8e-70b3-2bd6-9a56-a50177863357

Susan Bradley Patch Lady/Prudent patcher

1 user thanked author for this post.

John18

Reply | Quote

Susan,

I have one more theory.  I use Companion Link to link my iPhone with my Outlook account via Google.  Could that be what’s causing this?

Thanks,

John

Reply | Quote

When you say “via google” what do you mean?  I think there is something else trying to log in, but if it correlates to when your computer is on, and doesn’t do it when your computer is off, it’s more than likely some mismatch in a saved password somewhere on your computer.

Also did you check out that “who is logging into my account” link?

Susan Bradley Patch Lady/Prudent patcher

1 user thanked author for this post.

John18

Reply | Quote

CompanionLink can take calendar items, whether I add them at home on my PC into the Outlook Calendar and it synchronizes to my iPhone calendar by using the Google Calendar as a middleman.  I have had this for years and it is pretty slick.

Do I really think I am being hacked?  Probably not.  Is this disconcerting?  Yes.

Thanks.

Reply | Quote

https://support.microsoft.com/en-us/account-billing/check-the-recent-sign-in-activity-for-your-microsoft-account-5b3cfb8e-70b3-2bd6-9a56-a50177863357

What does it show when you click on that and go into your recent sign in activity?

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote

The same IP address consistently, which I take to mean it is just me.

Reply | Quote

Did you check to see where the email originated?

--Joe

1 user thanked author for this post.

John18

Reply | Quote

joep517 wrote:

Did you check to see where the email originated?

Microsoft account team <account-security-noreply@accountprotection.microsoft.com>

Reply | Quote

I think that may be a fake email address.

accountprotection.microsoft.com is not a valid site.

You’d need to see the mail headers to see what the real return address might be.

--Joe

1 user thanked author for this post.

John18

Reply | Quote

The header.  I put XXXXXX at where my email address showed.

Thanks.

Received: from SJ0PR07MB7808.namprd07.prod.outlook.com (2603:10b6:a03:286::21)
by BY5PR07MB6708.namprd07.prod.outlook.com with HTTPS; Thu, 27 Jul 2023
05:44:47 +0000
ARC-Seal: i=2; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=pass;
b=aAeBqiGlX4qClcNkKKDF/4VMTawsHfQH3JQcOBmgadxgzxuvPhwCaNy6o3HVWlWb+jVWVbHecdCyjC4M00eKWKb6GPXkzin7d7KlmPcx67hAntEWAUJRRw6pN8oix04Px4o70QMibBXw+1XWztNxwekPQRWTXJymQCrQjmpgmI2WrjqE9D6PkT9EQGNfkNkkv1mT2BLUC0VDQz4q2dVhcKGiFvYr5+mALSEywUdtpF1A3TWFbZRSailsKzd3Fi7+51f6bmK54RqbbnVAbmgr+MGO5u5duHqTwJUfOFp7Njmcp6YWxsd6e/uZTiZhERCMlBovtT/XTPooyCW6n1YRGw==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=sazqupjdKWcb5NyvElrPcMLhBihTPdTLYlUn5O1xIh8=;
b=VDT9+EkoLlOKOmno4QzW1yQ048za8zKUMXpSS+3cPHJcC+bTHz+xfSFynACZJVD/BNEMWHEMZvUEyXm3Ap59Abg5+2e7M+zpyQdGUy5wJ4jyE3rGRP0WjVSPTfEpXCrTEsWOSWUkMTnv61Uf8fNsa0QTZR/yidyZ7Ojc0cixzQCkmEIfGVGKVe0ysdWNbMjqn9Z6IF8GoBI/XYEudSYv/VGXSmgbFKfSg9fdDud10jhqnxT3bypJT/6KgnJnljxxhykypLbSVo0663VVux0hIT6PSAwqSqeOvjWu0M9jUK+ydbmDY+lHQVOfjl0JfeUAZDeWzS72AlG5+vAuzP1jqA==
ARC-Authentication-Results: i=2; mx.microsoft.com 1; spf=pass (sender ip is
40.107.243.52) smtp.rcpttodomain=outlook.com
smtp.mailfrom=accountprotection.microsoft.com; dmarc=pass (p=reject sp=reject
pct=100) action=none header.from=accountprotection.microsoft.com; dkim=pass
(signature was verified) header.d=accountprotection.microsoft.com; arc=pass
(0 oda=0 ltdi=1)
Received: from AS9PR05CA0010.eurprd05.prod.outlook.com (2603:10a6:20b:488::15)
by SJ0PR07MB7808.namprd07.prod.outlook.com (2603:10b6:a03:286::21) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6631.29; Thu, 27 Jul
2023 05:44:46 +0000
Received: from AM7EUR06FT016.eop-eur06.prod.protection.outlook.com
(2603:10a6:20b:488:cafe::1f) by AS9PR05CA0010.outlook.office365.com
(2603:10a6:20b:488::15) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6631.29 via Frontend
Transport; Thu, 27 Jul 2023 05:44:42 +0000
Authentication-Results: spf=pass (sender IP is 40.107.243.52)
smtp.mailfrom=accountprotection.microsoft.com; dkim=pass (signature was
verified) header.d=accountprotection.microsoft.com;dmarc=pass action=none
header.from=accountprotection.microsoft.com;compauth=pass reason=100
Received-SPF: Pass (protection.outlook.com: domain of
accountprotection.microsoft.com designates 40.107.243.52 as permitted sender)
receiver=protection.outlook.com; client-ip=40.107.243.52;
helo=NAM12-DM6-obe.outbound.protection.outlook.com; pr=C
Received: from NAM12-DM6-obe.outbound.protection.outlook.com (40.107.243.52)
by AM7EUR06FT016.mail.protection.outlook.com (10.233.255.104) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.6631.29 via Frontend Transport; Thu, 27 Jul 2023 05:44:42 +0000
X-IncomingTopHeaderMarker:
OriginalChecksum:8FEDE0CCDF0CBEEFF4CC7FA37395449D9289D8535F53783BFEAC950C3A374AB9;UpperCasedChecksum:718D63B6136018263575281142BC3A3A9AD97FA8EEB3B343450BE4916F85E817;SizeAsReceived:6678;Count:38
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=mssOT/VjUWhtb7Jkc7epyldAW2O6oWoMNQg9TcvasmZSetaDNnP4Ah3PF/xdzcgWjusQxzLnS7pWSgEKwj35PjtfOzapmh5eqlpqFG3B1ly6YDRXILV6ocrODUjg9fOi2icrhNnA4r2vd10eGUCwvF1ZDnl1CfSwidTBMEhE77gd/V9dWS2ZZNFZpavz9kn+LdVp45tL0Poz6WzR9hjr47XbVTqUZ9TvTssP6e0pzoazGtWStO3KTrHBcBZrl9RjhtA/Vd+5fyE0TuIjIMVAh8alrUCwMpmHvOKYQnrR+CgHzCfIcfrLHkijY+2x0mwDFAReIovu9BQr2nt2FBDdoA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=sazqupjdKWcb5NyvElrPcMLhBihTPdTLYlUn5O1xIh8=;
b=ddo3hYKku2NPw5rbMVUA+kd+V6GJjJA1W5JRUOM4ycbE19KpvArv1iUWgivMwKqgGLz/ciLJLWeZp4eNtqO6T4wrXorrMvhftzVZ5MrnnN+kjaGUrIAXZwMTpIoYpG7efTtIJUqzkJ8og3pDmk2NmF4BGMMA+Aj9Jz8EtPMTPUPSeisXmpAbHlohNo1ktcrwYA70jnzoSmOBtMDSKNuW5hLrpXA9k8uxBovyhxbyjGQrwChrzt/ginAycGWwcz0SDaySsDVT5uIok8iFrwoORQNb3VflEVEcupnfIuLCC32JnyLScfcv2K3CORcQlzHlV5pM9zLg/QJlftFEfydoKQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none
action=none header.from=accountprotection.microsoft.com; dkim=none (message
not signed); arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=accountprotection.microsoft.com; s=selector1;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=sazqupjdKWcb5NyvElrPcMLhBihTPdTLYlUn5O1xIh8=;
b=a+rthcSaMAdH4Uk8aBi6gWDf8yF34Vii8cCgZW85wBQsEm7rHwfjr7SgYyf4fuevqVBCyIjfRqGEFRrth3jZtwOKB9wv+MHac7KvlEtwd948Dy5sKtkQ4qbfbC9w2C7cg0oTkWHGh/ZMyFzkNOTY//xrqqAgA618I17eBGlRBfc=
Received: from SJ0PR03CA0257.namprd03.prod.outlook.com (2603:10b6:a03:3a0::22)
by BLAPR16MB3875.namprd16.prod.outlook.com (2603:10b6:208:27c::13) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6631.29; Thu, 27 Jul
2023 05:44:41 +0000
Received: from DM6NAM11FT086.eop-nam11.prod.protection.outlook.com
(2603:10b6:a03:3a0:cafe::90) by SJ0PR03CA0257.outlook.office365.com
(2603:10b6:a03:3a0::22) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6631.29 via Frontend
Transport; Thu, 27 Jul 2023 05:44:40 +0000
X-MS-Exchange-Authentication-Results: spf=none (sender IP is 52.188.222.33)
smtp.mailfrom=accountprotection.microsoft.com; dkim=none (message not signed)
header.d=none;dmarc=none action=none
header.from=accountprotection.microsoft.com;
Received: from accountprotection.microsoft.com (52.188.222.33) by
DM6NAM11FT086.mail.protection.outlook.com (10.13.173.75) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.6631.29 via Frontend Transport; Thu, 27 Jul 2023 05:44:40 +0000
From: Microsoft account team
<account-security-noreply@accountprotection.microsoft.com>
Date: Wed, 26 Jul 2023 22:44:40 -0700
Subject: Your single-use code
To: XXXXXXXXXXXXXXX
X-MSAPipeline: MessageDispatcherEOP
Message-ID: <HZKWW6EBKKU4.7D81T7DWDP5L2@BL02EPF00001955>
X-MSAMetaData:
=?us-ascii?q?DXk2otiDPgFSCZmYmQLlgLFxMiY4RnyiIi11CXQF!NlsQ5bXJg6tq6QBqJBt0?=
=?us-ascii?q?qOKZ5muTFO6!asEFPNlWXRDKfXKfH1oBlBffv2Rq!RYF!hrR*rhZQj3iP9od!?=
=?us-ascii?q?17jXnvvA$$?=
Content-Type: multipart/alternative; boundary=”=-QB9oxzpW2XEIrmeSBVc2qQ==”
Return-Path: account-security-noreply@accountprotection.microsoft.com
X-MS-TrafficTypeDiagnostic:
DM6NAM11FT086:EE_FirstParty-MicrosoftAccount-V3-System|BLAPR16MB3875:EE_FirstParty-MicrosoftAccount-V3-System|AM7EUR06FT016:EE_|SJ0PR07MB7808:EE_|BY5PR07MB6708:EE_
X-MS-Office365-Filtering-Correlation-Id: 466a9517-3bfa-4e0d-8020-08db8e6493a8
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam-Untrusted: BCL:0;
X-Microsoft-Antispam-Message-Info-Original:
j1f96VyXBhy0memixHRkxB/isQXc/gtGgkt+61lkcqYrzbocuq6dLvM/GPzEuPwAAj4psd3xIRUvjUevV8gzofJk1gwtQghlOJkhbcjdS3rl/ayB7C3IEsdQ+BvtW22unhGTgCIjbt+V4a/omlnqdIGwWy0aIcX9KEvu44/0RKfiNM/vj0wMHgJwb1g3nG+FHCfqfbL+Jl+ALWdAVDgQY9ZL23y2avFJV5iaRv4eKb37mP3XK6xDbEGYXRVdFP+0lKymjPb4QsrFKBEaNhebNl5JgBr7eS0Zj7RthN+o2leI95gXdqNJp+Ju/XcUCrWQb8kP7dTnjP+e6UjmIAKan6/uyi4jKGWQO26iHm9gJU22a3MdXSJohaGPYzQclwzzL6gVYFczCSHDzzsRVGZI2gvmWRiKFqv2VCuTxqrtv6ZNzuiW18SNrAfAQ3zEqoFL6MN6XmMTeBQRStUzzbF2bMbV14TbvvXjNZSB5J2/j/xBZQEbrYsTa7H2Rn7TWoo8rDdD4YxZbbK6JY8kV8VtJwiVR+qIP8+2uhuPToL0Tb2+xTqH88pzpjuB4AQx3GPtJFTgeolhhDL8HnhwwYhUgvkO3kAWCTqMN9X8eU00nP96fxH/1f301zQGG4+zOxriZzCs27pMEcnNJRT0LIxBBIc2Tm0I9qqYkWcqaifTevNTQo6NPpjTlvXRVTmy8eEbIJF5eMlja9AdW4K54/7NYKTmKt8R5EaEl9na2izsSj/ygFJeJFNJGpTAeQbmOBLGNZ6Hfx98vEep0MnJtCG+zg==
X-Forefront-Antispam-Report-Untrusted:
CIP:52.188.222.33;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:accountprotection.microsoft.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230028)(7916004)(39860400002)(346002)(42606007)(396003)(136003)(376002)(47530400004)(61400799003)(451199021)(33964004)(478600001)(9686003)(6512007)(6486002)(10290500003)(956004)(52230400001)(186003)(336012)(26005)(121820200001)(2906002)(118246002)(33716001)(316002)(68406010)(6916009)(356005)(8936002)(3480700007)(5660300002)(8676002)(41300700001)(9316004)(36736006)(81166007)(33656002)(86362001)(83380400001)(66899021);DIR:OUT;SFP:1101;
X-MS-Exchange-AntiSpam-MessageData-Original-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-Original-0:
2xOrlWKyt5RpHtthEZcWOcxtoH/OcXtPStj9D9XOAbE8ySkZB8OhB5U1qy6ahgHTfQ3q5c2HKl0AvglBWpeIUI7lCAu7lKmcWxWYwiswvweDJRM04pJgE2HML7MLJZYCT5tSnxrFp27rUsnQkwzHZhHN9b+oOzsGxbfZMMaZRHMvsUWi2PbWLGCVjmSjgzpM1DMYA6H67aS26dYDpHLPILkU8R4c3zEM6JG44aUXa107/yIPNxJYNvpTMS6VJ1gvSiFN3v8wb0fQPr8QR82TCCxQGavgZnQIBDcBnSDPOGjSQrSTRbO8IBmnFomVnmKxDRL8UsO6GrVBKkwWeHI+rbN15aVfya8y0ZJh2vNw4KDhdbHsA4awJ0gmnu4hKMGRQPWCkhZXsMDrXkdJuSP2SwYIhCb1VS/4vOCO3l9PKL1XpEOaIyltJinWY5PV36bHONzYSxQZQoN41H/mvUeUtyCwa7nHWrgFQYxzsoFthTJzU58JCrvGMyKM052Ysu2tGuERDaip9tm7px36SceB2Q==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLAPR16MB3875
X-IncomingHeaderCount: 38
X-MS-Exchange-Organization-ExpirationStartTime: 27 Jul 2023 05:44:42.8224
(UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id:
466a9517-3bfa-4e0d-8020-08db8e6493a8
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-MS-Exchange-Transport-CrossTenantHeadersStripped:
AM7EUR06FT016.eop-eur06.prod.protection.outlook.com
X-MS-Exchange-Transport-CrossTenantHeadersPromoted:
AM7EUR06FT016.eop-eur06.prod.protection.outlook.com
X-MS-PublicTrafficType: Email
X-MS-Exchange-Organization-AuthSource:
AM7EUR06FT016.eop-eur06.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-UserLastLogonTime: 7/27/2023 5:43:20 AM
X-MS-Office365-Filtering-Correlation-Id-Prvs:
6e3ad8ec-154b-4cd7-54e7-08db8e649252
X-MS-Exchange-EOPDirect: true
X-Sender-IP: 40.107.243.52
X-SID-PRA: ACCOUNT-SECURITY-NOREPLY@ACCOUNTPROTECTION.MICROSOFT.COM
X-SID-Result: PASS
X-MS-Exchange-Organization-PCL: 2
X-MS-Exchange-AtpMessageProperties: SA
X-MS-Exchange-Organization-SCL: -1
X-Microsoft-Antispam: BCL:1;
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Jul 2023 05:44:42.6974
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 466a9517-3bfa-4e0d-8020-08db8e6493a8
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5ba90553-c2cd-460e-b5fd-ab93ad9155c7;Ip=[52.188.222.33];Helo=[accountprotection.microsoft.com]
X-MS-Exchange-CrossTenant-AuthSource:
AM7EUR06FT016.eop-eur06.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:
00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR07MB7808
X-MS-Exchange-Transport-EndToEndLatency: 00:00:04.5354961
X-MS-Exchange-Processed-By-BccFoldering: 15.20.6631.026
X-Microsoft-Antispam-Mailbox-Delivery:
abwl:0;wl:0;pcwl:0;kl:0;dwl:1;dkl:0;rwl:0;ucf:0;jmr:0;ex:0;auth:1;dest:I;OFR:TrustedDomainList;ENG:(5062000305)(920221119063)(90000117)(920221120063)(90012020)(91020020)(91040095)(9050020)(9100338)(944500132)(4810010)(4910033)(8820095)(9910022)(9510006)(10110021)(9424006)(9310011)(9220031);
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0xO0Q9MTtHRD0xO1NDTD0tMQ==
X-Microsoft-Antispam-Message-Info:
=?utf-8?B?OExVT1M2MjRuOWdTNmRqNEMreTE4c1NQSWFsTlZHM3dnOG9QRWM1QTgvSVFr?=
=?utf-8?B?VEIvMUovV09CY1RwcDF5NG1La09hSGVvWXU4YmhuSU01Z09qbWEwREE4RkhG?=
=?utf-8?B?d2VlcW1ML1hEZ1BIZmFyenkvYmN3Rzg2V2xlbnJVbkhuYllpU0dzVUNMT1N0?=
=?utf-8?B?MjFacU83SWd5SWVzbmVIRjN4MU1mNnI3aEZkUmk3TmpZTXdqcjhYZlRCMGdO?=
=?utf-8?B?UXFrMlVNdnVVdmpLa1NkL2hRVzZPU0dTQ0lyUFVJNFdTZ2VDWW9NNm9OUS9E?=
=?utf-8?B?TlZIK0FOaGhRcHkyMmpJV1ZvN3VtemR4Vks2NG9vUFhrV2cvb1RLZ3RObkQ5?=
=?utf-8?B?WFR5aFFvYUx3ZThaZWNESkEyS2hhNnE4aUJ6Tkx5SkRVa1VMRGxmcW5qOVZk?=
=?utf-8?B?NmFpcjVRSDZKd1NoOEk0c1I3UTNGZnZOK0lvV1V1b2pDcHA4VUpqcGM4TlJY?=
=?utf-8?B?QVQzdkZZcnpZYzJyV2ltNjlnMGtHQjU5YWdVZHJXcUZFVDg3Q1JXOHlHazJl?=
=?utf-8?B?amY2TGxFbnppaG1FMzQ0TDFTZ042SnU4SndWQmpSR3p6eTRDVjdQNE9FejNN?=
=?utf-8?B?d3NEY3F5OG9YZVZXU3BwYkJPMkx4WTROQk5kNEN3WHBGTmpuVTJtcHlkR0ZJ?=
=?utf-8?B?ei9KUFhXRlBMMmt0K3dVYWxLMjRWU0xRUlVZYUw4YnQreXFSSHJwMjhEa2RL?=
=?utf-8?B?S2tpZmhUTHlJTzVZY0JINHlIMTM3QXRBMHBndVlhbU9tQzY2MFhEcEZlMnZ6?=
=?utf-8?B?bGlVS3lWNlRSWlFLa1BFZy80MnJtNHN0amFYZmRVNG93MEVvejhHSE45Y1VF?=
=?utf-8?B?WUdWT2VhTDF1dDBSVVAwcCs2aGhaZzdVTVNvdFRuSjVQMzZacno1UkhOWkJV?=
=?utf-8?B?d3QxL3dtMDJQUTIxVUJ3NmEyRUVTRmtTWTZHeGRRMGdhL2lwRmlReXdIcDlG?=
=?utf-8?B?TGgxU3QrcUFuclM5OFR5N1dHM1VURnpORXIvS3dHa2lDLzFYQU5yTmExVlBh?=
=?utf-8?B?Qk85MytpM3l1UmFEcGlFSG12WEpObWdWRU52d1oyOFNITnF1NjJ4ZTR1UHNp?=
=?utf-8?B?QitSUU5iTDVRMHhHUWc2bko1ZVRYNVBUZG5OdDZKbER5R1pWSks5ZDUrSGVE?=
=?utf-8?B?bjVuSzdwWlRGbEd6QzQ0YkpJSkljUzZTUFFGT1E2N1JGdW5JSmtnWjJJeko1?=
=?utf-8?B?REhxVEFxcnp2MFpYZzhMaDFiQ0g0TmFrejBvWk1FYkhBY1k1QjRRRlV2enZX?=
=?utf-8?B?MDBqelcxUW1FeFBOckdseDRMWDBFMnpJVzFjR0FXWEVFb214SHpPbTZMT1lq?=
=?utf-8?B?L0oyeUR3Qk1RS3E1bXp3VDJET0d2TXV3SUo1L29VNFkwMWRvNHVXRUdxUDhz?=
=?utf-8?B?amJKMDMxa1FidzVUZUYzdnlIaFNqM1ozL25PaVN6THdsYzFLWVVEMEwya093?=
=?utf-8?B?NGt6MUlPb2FQYjdWaHpsMmVHM1FOMlpVeXBCRGxRWUV4eWNxeTNkYWxZYkdl?=
=?utf-8?B?bmwzTTFURURKcWE4RFFyWTNnc2VRSEpoQXplYVhrcjc2akQzdkFpRDR0SjQ0?=
=?utf-8?B?NkN1RVdaallSUXNUdTNCajVQTnQyZTh0REx4MkVFR0dxZVNYc0JaV0U0N1NQ?=
=?utf-8?B?bURlRHFsNFRKZ29pZFU4dHlid0g5Zy9RZkFBNjd0aHovTVgrVGIrTGJ4bkJV?=
=?utf-8?B?RU1sY0lSdnlUbjVlcEZhQnkvR0xMZCtpU25IbGIwaWVXRXNVR3crSlRmc0x1?=
=?utf-8?B?VElZMCszd1RsSXUzd3NnOTh2Nk5wUDZCMEN1cmF2STVhWTRaZ3U3Y1R4VHNx?=
=?utf-8?B?RFMxRzR5cXNVUEorNCs1UDZWQjhrRGVNWlBIRGkwQlFBYUloYlZzT2pIUXNP?=
=?utf-8?B?bDdaVG1pUHRkZHl1MTJPaWFmWlI0eld1cmtDUERsRmN6bklHc0lyNkFxalBE?=
=?utf-8?B?K0x0TEVCQzVHeEtPZlB0SHMzdkN2UFB6MnltaHdGUFloTWlsQ0tyaWhrSHdI?=
=?utf-8?B?aythdHJ3U2gvcmZhbXFiMWNkanc5bnBoLzh6cFljVVNSc01yNmZHSk85cHRG?=
=?utf-8?B?bi9qeXl5SUxTd21jbEpTT1pWU3lJVzgvK3lqK3pLWTk1TFNuY1FaUitpMk9J?=
=?utf-8?B?cnZWYWd2NGNqUlVVVFZTSFpMUEYwVGVYQ3ltenNjaHFzL005aDN5MmZpOWRi?=
=?utf-8?B?aE16RDdOZWlqRWlvSFNGS2h5UTh1dVZMSFpSa1ZNd2ZSOEpOc3p6MDZ2aTI0?=
=?utf-8?B?THZGbkFJbDRQcmEwaVMwOElmNk0yTGVMbjZjdHVraFMxaUgzZlB1UFRuaVd0?=
=?utf-8?B?NllRSUUzRGp5bzdBUGhHa0JPL1o3TU9aR2xGSVpvMWIrdVoxRDFGeUtLUlFp?=
=?utf-8?B?OHhZMkJvNTUvR1BabGQ5K3RLRVhJRlhZQzcyL0tLa0tUaE05QTdZTEJGNVRs?=
=?utf-8?B?VDV5T1JNeXBjOC95dzFpS3pxV0svbmhtZmIyT3hURElUY0hZRDdVTHM2S0lX?=
=?utf-8?B?SXlSMmVjSnBZUUY3bEZrd3hnL0hKdzdJMGhIY1krc3IwSU1DUzI2Z0kxc3No?=
=?utf-8?B?S25nVEdaSWs2UmY4MmdnZnR2Nlp3RVlObytNNVp3RTFac0I4eE9vQVFDakw3?=
=?utf-8?B?bWlnNjR1VnY4RW5jQ0FONzFqOUtsaFFKbTNnQlNwZTUwRzBXWXVSRUVLa1dU?=
=?utf-8?B?RWJVYXpTUENIZFEvTnZYVkxmTmx6QTRjUW5sMm1FbnA1bXQyRnRQM200VVZF?=
=?utf-8?Q?BQ=3D?=
MIME-Version: 1.0

Reply | Quote

Well, it appears I was wrong. That is a valid address according to Microsoft – Can I trust email from the Microsoft account team? – Microsoft Support. Don’t know what to do other than what you have done changing the password. Once your address is out in the wild, many strange things are possible.

--Joe

1 user thanked author for this post.

John18

Reply | Quote

Thanks.  I really thought that I had jumped through the hoops to make sure I checked everything.

I am going to leave this thread open through the rest of the day in case someone else has an idea, and then I will close it.

Thanks again.

Reply | Quote

John18 wrote:

This had been happening enough that I changed my Outlook password to something really long and really random, plus I have 2FA in force using an authenticator app.

It could be a hacker breaking into your account and using a bypass for 2FA. 2FA has become very easy to break into. It was secure years ago but now with modern system it is just a few clicks away to get in. There is no way to protect against it. 99% of the time you will no see anything if it was a professional hackers. My guess is that this might be some kid who found about it and is using it. I love how kid scripts now days do things without fulling know how it works.

Reply | Quote

Please provide evidence that “2FA has become very easy to break into.”

As Microsoft’s recent cloud zero day has showcased, no, two factor is not easy to break into unless you have somehow stolen the keys to cloud signing certificates.

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote