How to Report a Scam Email Using an onmicrosoft.com Address
Question details
The user received a threatening scam email appearing to come from an onmicrosoft.com domain, claiming their devices have been hacked, and needs to know the proper way to handle it.
- Product
- Microsoft 365 Email
- Device & OS
- not provided
- Scenario
- Receiving a phishing, blackmail, or spoofed email from a Microsoft business or school account address.
- Observed behavior
- A deceptive email is received demanding action or claiming a security breach, using an onmicrosoft.com domain to bypass filters and appear legitimate.
Do not panic, reply to the sender, click any links, or download attachments within the email. These are automated mass-phishing attempts designed to scare you into revealing sensitive data or paying a ransom.
Report the Phishing Attempt and Block the Sender
The most effective immediate action is to report the email as phishing through your current email provider, which updates global spam filters and protects other users.
Because scammers often spoof email addresses to make them look like they are coming from a legitimate Microsoft tenant, simply replying or contacting Microsoft Support usually will not yield an investigation. Using your email client's built-in reporting tool is the best protocol.
Keep the email unopened if possible, or if it is already open, do not click on any hyperlinks or download any attached files.
In your email client (such as Outlook, Gmail, or Apple Mail), locate the 'Report Phishing', 'Mark as Spam', or 'Junk' button on the top toolbar and click it to flag the message.
Right-click the sender's email address or open the message options, and select 'Block Sender' to prevent future emails from that specific spoofed address from reaching your inbox.
Preserve Email Headers for Advanced Investigation
If you need to escalate the incident to your IT department or local cybercrime authorities, you must capture the email's original headers to trace its true origin.
Looking for a Secure, Lightweight Office Alternative?
While navigating email security and avoiding cloud account scams, you might prefer a simpler, safer office suite for your daily document needs. WPS Office provides a free, lightweight, and highly compatible alternative to Microsoft Office without the complexities of managing cloud tenants.
- 1. Download the installer: Visit the official WPS Office website and click the free download button for your specific operating system.
- 2. Install the software: Run the downloaded installation file and follow the simple on-screen prompts to set up the suite on your computer.
- 3. Open your existing documents: Launch WPS Office and directly open your Microsoft Office files to continue working seamlessly without formatting loss.
Frequently Asked Questions
Were my devices actually hacked or recorded like the email claims?
In almost all cases, no. These are automated scam emails (often called blackmail or sextortion scams) sent to thousands of random addresses. The claims of hacking or recording are completely fabricated to induce panic.
Why did the scammer use an onmicrosoft.com address?
Scammers often spoof 'onmicrosoft.com' domains or create temporary free trial accounts because these domains are associated with legitimate Microsoft 365 business or school tenants. This tactic helps their deceptive emails bypass basic spam filters.
Can Microsoft track down the sender if I report the exact email address?
Usually, no. Because the sender address is typically spoofed (forged) or created using stolen/fake credentials, Microsoft Support cannot effectively investigate or shut down the actual attacker based solely on the displayed sender domain.
