Suspicious Login Issues

How to Identify and Handle a Moscow Microsoft Account Access Scam Email

Phi Hung Vo Oct 22, 2026 869 views

Question details

The user received an unexpected email claiming their Microsoft account was accessed from Moscow and wants to know if it is a phishing scam.

How to Identify and Handle a Moscow Microsoft Account Access Scam Email

Product: Microsoft Account
Device & OS: not provided
Scenario: Evaluating a suspicious security email alert regarding unusual account sign-in activity.
Observed behavior: The user received a deceptive email from an unfamiliar sender (like toontrack) using image-based links or mailto prompts, urging them to act on an alleged Moscow login.

Before you start

Do not click any links, images, or reply buttons in the suspicious email. Open your web browser directly to navigate to the official Microsoft website instead.

Solution 1Recommended

Identify the Scam and Secure Your Account Manually

Follow these steps to safely verify your true account status, block the malicious sender, and apply essential security measures.

This specific scam uses fake sender addresses, such as 'donotreply@toontrack', alongside image-based links or 'mailto' links. Their goal is to trick you into entering credentials on a fake webpage or to harvest your email address by tricking you into replying.

Avoid Interacting with the Email Content

Do not click on any buttons, text links, images, or 'mailto' links within the message. Engaging with the email can confirm your address is active to scammers.

Verify Sign-in Activity on the Official Website

Open a new browser window and manually type 'account.microsoft.com'. Log in, navigate to the 'Security' tab, and click 'Sign-in activity'. Check here for any actual unauthorized logins from Moscow. If none appear, the email is definitively a scam.

Block the Malicious Sender

If you are using Outlook, go to Settings > Mail > Junk email > Blocked senders and domains. Add the scammer's exact email address to this list to prevent future messages.

Report the Email as Phishing

Select the suspicious email in your inbox, click the 'Report' button in your top toolbar, and choose 'Report phishing'. This helps improve the email provider's spam filters.

Identify the Scam and Secure Your Account Manually

What to do if you already clicked the link: If you entered your login credentials on the linked site, immediately change your Microsoft account password, log out of unfamiliar sessions in your Security settings, and enable multifactor authentication (MFA).

Free Microsoft Office alternative

Stay Secure and Productive with WPS Office

If you are dealing with account security concerns or simply looking for a standalone, reliable productivity suite, WPS Office provides a robust, lightweight, and free alternative to Microsoft Office. Work efficiently with your documents without tying your offline productivity to a complex cloud ecosystem.

1. Download the Software: Visit the official WPS Office website and click the free download button for your specific operating system.
2. Install WPS Office: Run the downloaded installer file and follow the straightforward on-screen instructions to complete the setup.
3. Open Your Documents Securely: Launch WPS Office and directly open your existing Microsoft Office files to continue working securely.

Fully compatible with Microsoft Word, Excel, and PowerPoint formatsLightweight architecture that runs smoothly on almost any deviceRobust offline document editing for enhanced privacy and securityFamiliar user interface ensuring a seamless migration process

microsoft office alternative - wps office

Frequently Asked Questions

How can I tell if an email from Microsoft is legitimate?

Legitimate Microsoft security emails always come from the exact domain '@accountprotection.microsoft.com'. If the sender address is different, such as a random string or a domain like 'toontrack', the email is a scam.

What happens if I accidentally clicked the 'mailto' link in the scam email?

Clicking a 'mailto' link automatically opens a draft email to the scammer. If you send it, you confirm to the scammer that your email address is active, which may result in an increase in targeted spam. Simply delete the draft and do not send it.

Do I need to change my password if I only opened the scam email?

No. Simply opening or viewing the text of a phishing email typically does not compromise your account. You only need to change your password if you clicked a link inside the email and entered your login credentials on a fraudulent website.

Microsoft Office Security Issues