“Unusual sign-in activity”: real alert or scam?

Why it is tricky

Real services do send these alerts, and they matter. Scammers know that, so they copy them. A fake alert with a “Review activity” or “This wasn’t me” button takes you to a fake sign-in page.

How to check safely

Never use the link in the message. Instead:

• Open the app or type the website address yourself, sign in, and look at the security or recent activity page. Real alerts will show there too.
• For a work Microsoft 365 account, go to your Microsoft account’s security information page, or ask your IT provider. They can see the real sign-in history.

Signs the alert is fake

• The sender address is not the company’s real domain.
• The button asks you to sign in or “verify” immediately.
• It asks for a code, a password or payment details.
• The details are vague, with no time, location or device.

If the alert is real

Someone may have your password. Change it straight away from a trusted device, check that multi-factor authentication is on and that no unknown phone or app has been added. For a work account, tell your IT provider so they can sign out every session and check for anything the intruder changed.