Overview
Microsoft 365 sends legitimate security and sign-in alerts via email only from verified Microsoft domains, but you must watch out for sophisticated phishing scams that mimic these alerts.
How Legitimate Microsoft 365 Alerts Work
- Triggers: Microsoft sends an email or text alert when an unusual sign-in attempt happens from a new device or unfamiliar location.
- Official Senders: Real security alerts come from trusted addresses ending in domains like
microsoft.com, microsoftsupport.com, office.com, or accountprotection.microsoft.com.
- Safe Verification: Real messages never include attachments or demand urgent action under threat of account deletion.
Problem
Someone receives an email message with the following warning attached:
|
|
This sender failed our fraud detection checks and may not be who they appear to be. Learn about spoofing
|
Feedback
|
Resolution
These messages are being generated by Microsoft 365. It automatically checks email to see if it is coming from people on our approved lists.
What you should do
- Be cautious: Do not click on any links or download attachments, especially if you don't recognize the sender or the email seems suspicious.
- Verify the sender: Contact the sender through a separate, trusted method (e.g., by phone or a new email) to confirm they sent the message and that the information is legitimate.
- Check for more information: To understand the technical reason for the warning, you can view the email's "full headers" to look for the Received-SPF line, which indicates the result of the SPF check.
- Mark as junk or safe: If you recognize the sender and trust the email, you can add them to your safe senders list to prevent future warnings. If it is a clear phishing attempt, report it as junk or phishing.
Additional Information
Need additional information or assistance? Contact the IT Help Desk Chat Line or call the IT Help Desk at 979-830-4357 (HELP).