The checker reads one suspicious email. Batmail reads your whole inbox overnight.
Paste the Microsoft email into the checker and it reads it for the signs below.
The checker reads the sender address, the wording, any link address you paste with the email and what the email asks you to do. It gives a verdict, a risk score from 0 to 100, the exact wording behind each red flag and what to do next. It is free and needs no signup.
Batmail phishing email checker
A fake Microsoft alert reports a strange sign-in and asks for your password.
Microsoft’s own page says it sends an email and an SMS alert when it notices a sign-in attempt from a new location or device. A scam copies that, which is why the topic proves nothing and the details matter. The email below is invented, and each number is one of the signs.
Example
Hello customer,
We detected a sign-in to your account from a new device in another country.
Verify your identity within 12 hours or your account will be suspended.
You will be asked for your password and a security code.
The button says account.microsoft.com/security
The sender's address is not accountprotection.microsoft.com.
Microsoft says that if the email address domain is @accountprotection.microsoft.com, it is safe to trust the message. This one is at someone else's domain.
An alert about a sign-in, which Microsoft does send.
Microsoft says it emails and texts you about a sign-in attempt from a new location or device, so the topic alone proves nothing.
A deadline and a threat to suspend the account.
The FTC says phishing messages claim there's a problem with your account or your payment information when there isn't.
A request for your password and a security code.
Microsoft says a real alert may need a security code, entered by following the instructions on the sign-in screen.
A button that says account.microsoft.com and goes somewhere else.
Microsoft says a sign of phishing is that links or URLs in the email are not pointing to the correct location.
From Microsoft Support: What happens if there's an unusual sign-in to your account, read 7 November 2026.
From Microsoft Learn: How to protect against phishing attacks, read 7 November 2026.
From FTC Consumer Advice: How To Recognize and Avoid Phishing Scams, read 7 November 2026.
Microsoft names the one domain its account emails come from, so read the sender against it.
Anyone can put “Microsoft” in front of an address. The part to read is the domain, after the @. Read it from the right: the last two parts name the owner, and everything in front of them is only a label the owner chose. Microsoft says it uses accountprotection.microsoft.com to send email notifications about your Microsoft account, including security codes and password-change notices, and the owner of that address is microsoft.com. It also says you can view the email’s message headers to be sure.
Read the domain from the right
accountprotection.microsoft.com
From MicrosoftOwned by microsoft.com. Microsoft says it uses this domain to send email about your Microsoft account.
microsoft.com.secure-check.example
Not from MicrosoftOwned by secure-check.example. microsoft.com is only a label in front of it.
microsoft-account-alert.example
Not from MicrosoftOwned by microsoft-account-alert.example. The name has Microsoft in it, but the owner is someone else.
From Microsoft Support: Can I trust email from the Microsoft account team?, read 7 November 2026.
A real alert is checked on your Recent activity page, which you open yourself.
Microsoft’s page for an alert you did not expect gives a short route that never goes through the email. You start at the Security basics page for your Microsoft account, which you reach by signing in yourself.
The check
- The alert says
There was an unusual sign-in.
Nothing in the email proves it.
- You open it yourself
Sign in to Security basics, then select Review activity.
Microsoft sends you to the Recent activity page to check for unusual sign-in attempts.
- If it wasn't you
Select This wasn't me or Secure your account, then change your password.
Microsoft says to go back to Security basics and select Change password.
From Microsoft Support: What happens if there's an unusual sign-in to your account, read 7 November 2026.
Microsoft's pages give four checks for deciding whether to trust an account email.
| Question | What Microsoft says | What a fake Microsoft email does |
|---|---|---|
| Is the domain accountprotection.microsoft.com? | What Microsoft saysMicrosoft says that if the email address domain is @accountprotection.microsoft.com, it is safe to trust the message and open it. | What a fake Microsoft email doesIt comes from a look-alike domain with Microsoft in the name. |
| Did you request the code or do the sign-in? | What Microsoft saysMicrosoft says to check that the account the email is hinting at belongs to you, and that you requested the code. | What a fake Microsoft email doesAn alert about a sign-in, or a code you never asked for. |
| Does it greet you by name? | What Microsoft saysMicrosoft lists as a sign of phishing a greeting that doesn't personally address you. | What a fake Microsoft email does“Hello customer,” or no name at all. |
| Does it come with a reset link from support? | What Microsoft saysMicrosoft says its support agents are not allowed to send password reset links, or access and change account details. | What a fake Microsoft email doesA link to reset your password or verify your identity. |
From Microsoft Support: Can I trust email from the Microsoft account team?, read 7 November 2026.
From Microsoft Learn: How to protect against phishing attacks, read 7 November 2026.
Five steps tell you whether a Microsoft email is real without clicking anything.
- Leave the button and every link alone, and give nobody a security code. Microsoft says to contact the business by known channels if you are in doubt.
- Read the sender’s address from the right, as in the picture above. If it is not
@accountprotection.microsoft.com, do not trust it as an account email from Microsoft. - Sign in to your Microsoft account yourself, open the Security basics page and select Review activity. Microsoft says this shows any unusual sign-in attempts on the Recent activity page.
- Paste the email into the checker at the top of this page for a second read.
- Report it. In Outlook.com, select the check box next to the message, select the arrow next to Junk, then select Phishing. In Outlook, select Report message from the ribbon, then Phishing. In Gmail you can choose More next to Reply, then Report phishing.
From Microsoft Support: What happens if there's an unusual sign-in to your account, read 7 November 2026.
From Microsoft Learn: How to protect against phishing attacks, read 7 November 2026.
If you clicked or typed your password, Microsoft says to change your passwords at once.
Microsoft’s guidance on phishing says that if you think you have been a victim, you should immediately change all passwords associated with the accounts, and report any fraudulent activity to your bank and credit card company. On a work computer it says to contact your IT admin first. If you cannot sign in, Microsoft’s page says your password may have been changed and points you to its steps for getting back into your account.
What to do depends on what you did
You only read it.
Report it as phishing in your mail app and delete it.
You clicked the link.
Sign in to your Microsoft account yourself and review the Recent activity page. If something may have downloaded, update your security software and run a scan.
You typed your password or card details.
Change all passwords associated with the accounts, and report any fraudulent activity to your bank and credit card company. Follow the steps at IdentityTheft.gov for what you shared.
From Microsoft Learn: How to protect against phishing attacks, read 7 November 2026.
From Microsoft Support: What happens if there's an unusual sign-in to your account, read 7 November 2026.
From FTC Consumer Advice: How To Recognize and Avoid Phishing Scams, read 7 November 2026.
From Gmail Help: Avoid & report phishing emails, read 7 November 2026.
The same checks work on other account and document emails.
An account alert is one of the most copied emails. The guide to fake Apple receipt emails covers a locked Apple Account, and the guide to fake Docusign emails covers a document you did not expect. The holiday scam emails guide puts the kinds side by side.
These are the questions people ask next.
What address do real Microsoft account emails come from?
Microsoft says that if the email address domain is @accountprotection.microsoft.com, it is safe to trust the message and open it, and that it uses this domain to send email notifications about your Microsoft account. Its sign-in page names account-security-noreply@accountprotection.microsoft.com, and says you can also view the message headers to be sure.
Why would Microsoft email me about a sign-in?
Microsoft says that when it notices a sign-in attempt from a new location or device, it sends you an email message and an SMS alert. It may ask for a security code so it knows it was you, for example if you sign in while traveling or install a new app that signs in with your account.
How do I check a sign-in alert without using its link?
Microsoft says to sign in to the Security basics page for your Microsoft account and select Review activity to check the Recent activity page. If the activity was not yours, select This wasn't me or Secure your account, and change your password from the Security basics page.
Will Microsoft support send me a password reset link?
No. Microsoft says its support agents are not allowed to send password reset links, or access and change account details. If you cannot sign in, Microsoft's page says to start with its steps for when you can't sign in to your Microsoft account.
Where do I report a phishing email to Microsoft?
Microsoft says that in Outlook.com you select the check box next to the message, select the arrow next to Junk, then select Phishing. In Microsoft Office Outlook, select Report message from the ribbon, then Phishing. Microsoft also has a Report a support scam page at microsoft.com/reportascam.
What if I clicked the link or typed in my password?
Microsoft's phishing guidance says to immediately change all passwords associated with the accounts, and to report any fraudulent activity to your bank and credit card company. If something may have downloaded, the FTC says to update your computer's security software, run a scan and remove what it finds.
Every step on this page comes from these official pages.
Read on . Spot a step that has changed? Email support@batmail.ai and we will fix it.
- Microsoft Support: Can I trust email from the Microsoft account team?
- Microsoft Support: What happens if there's an unusual sign-in to your account
- Microsoft Learn: How to protect against phishing attacks
- FTC Consumer Advice: How To Recognize and Avoid Phishing Scams
- IdentityTheft.gov
- Gmail Help: Avoid & report phishing emails