Microsoft Account Deactivation e-mail scam: how to spot it and what to do
Microsoft Account Deactivation is a phishing scam email that tricks users into entering credentials on fake websites. Delete it without clicking links; legitimate Microsoft emails use @accountprotection.microsoft.com.
Facts checked October 5, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Do it yourself · free Remove Microsoft Account Deactivation e-mail scam yourself 4 steps, about 12 minutes, no software needed.
Start the steps
Microsoft Account Deactivation e-mail scam: summary
| Distribution | The fake message is received via email |
|---|---|
| Name | Microsoft Account Deactivation |
| Type | Scam, phishing email |
| Dangers | Personal account detail disclosure to cybercriminals, malware infection |
| Symptoms | A phishing e-mail asking you to sign in |
| Evidence | 4 write-ups by security sites; details still limited |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 7 more facts
| Arrives as | |
|---|---|
| Pretends to be | Microsoft |
| Claim | Your account needs urgent attention |
| Sender domain | no-reply@microsoft.com |
| Asks for | Your password |
| First seen | 24 May 2022 |
| Facts checked | 5 October 2026 |
What the Microsoft Account Deactivation e-mail scam e-mail looks like
Microsoft Account Deactivation
Dear
We received a request from Microsoft to Deactivate your account, you accoint will be removed from our system shortly and will be permanently deleted within 7 days.
Please ignore this message if you made this request. To cancel request do so by verifying your details below
Verify Account
If you have additional questions, please contact customer service.
Thanks,
Microsoft Account Team
How to tell the Microsoft Account Deactivation e-mail scam e-mail is fake
- Sender:
no-reply@microsoft.com
Is Microsoft Account Deactivation e-mail scam dangerous? What the senders want
From our report of May 2022 · not reviewed since
Microsoft Account Deactivation is a fake message you might receive from scammers in your email
Microsoft Account Deactivation is an email scam you might receive one day unexpectedly.
Many users are unpleasantly surprised by it, as they have not requested an account deactivation service. This makes many people wonder whether or not the email is legitimate and can be trusted - the answer is no.
Upon receiving the email, users are warned that their Microsoft accounts will be permanently deleted within seven days, as the request has been received to do so. They are also notified that they should click the link below to verify their account if this request has been made by accident.
Users who click the "Verify Account" link would be redirected to the Microsoft spoofing site, where they would be asked to enter their account name and password. Unknowingly, victims of the Microsoft Account Deactivation scam would be providing their account details directly to cybercriminals, which can later be used for other malicious purposes.
From our report of May 2022 · not reviewed since
The fake message and what to expect
Spam and phishing emails are something that has been around for decades now, as it makes an effective method of malware distribution.
Opening booby-trapped MS Office documents, for example, are among the most prevalent ways of getting your system infected with malware.
Not all email spam is dedicated to malware. There are plenty of fake messages that pretend to come from legitime, high-profile sources such as Netflix or Amazon, which attempt to steal user credentials of the said account.
For example, if you are using Netflix, you could receive a fake email claiming that your account was compromised and you have to verify it by entering your credentials - that's where a hyperlink to a spoofing website is provided.
Here, we are dealing with this example's analogy, apart from it using Microsoft's name instead. Here's the full message you might expect when dealing with the Microsoft Account Deactivation email:
What is relatively unique about this scam is that it's crafted rather carefully - it contains no grammar or spelling mistakes, and the email address it was sent from seems relatively familiar - "no-reply@microsoft.com." However, it is important to note that the email is not that of a legitimate Microsoft account team and is simply a fake. You should only trust emails that use "@accountprotection.microsoft.com" instead.
Those who fail to recognize the deception and click the "Verify Account" button might be redirected to a fake Microsoft page, where they will be asked to enter their account credentials. The website would look identical to that of Microsoft's official one and might be impossible to identify visually.
What to do after the Microsoft Account Deactivation e-mail
If you only received the message and clicked nothing, step 3 is all you need.
If you clicked the link or typed anything on the page it opened, do every step, starting with the password.
Step 1: Change the password you typed on the fake page
If you entered a password after clicking the link in the Microsoft Account Deactivation message, treat that account as known to the sender.
Open the provider's real site by typing its address yourself, not through any link in the e-mail, and change the password there. Choose a new one you have never used before, and change it on every other account that shared the old one.
Then use the option to sign out of all other sessions or devices, if the provider has one. This works the same in any browser on Windows 11 and Windows 10.
Microsoft account, Security page (account.microsoft.com/security): Change password. Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Step 2: Turn on two-step verification
Two-step verification asks for a code from your phone or an authenticator app whenever someone signs in from a new device. A stolen password alone is then not enough to open the mailbox.
Turn it on in the security settings of the e-mail account first, then for the bank, shop and social accounts that send their reset links to that address.
While you are there, check the recovery e-mail and phone number and the forwarding rules, which attackers sometimes change to keep access. The settings pages look the same on Windows 11 and Windows 10.
Microsoft account: Manage how I sign in, where two-step verification and the sign-in methods are. Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Step 3: Report the e-mail and delete it
Report the message instead of only deleting it. In Outlook choose Report > Report phishing, in Gmail the three-dot menu > Report phishing; the provider then blocks the same message for other people.
Do not reply and do not click anything else in it. On a work account, forward it to your IT team as an attachment first. Web mail and the mail apps on Windows 11 and Windows 10 offer the same options.
New Outlook for Windows and Outlook on the web: Report > Report phishing. Full procedure with screenshots: Report a phishing e-mail
Step 4: Scan the PC if you opened a file from the message
A page that only asked for a password installs nothing, so most readers can skip this step.
If the Microsoft Account Deactivation e-mail or the page it opened made you download or open a file, delete it and run a full scan, then a Microsoft Defender Offline scan.
In Windows 11 and Windows 10 open Windows Security > Virus & threat protection > Scan options, select Microsoft Defender Antivirus (offline scan) and click Scan now. The PC restarts and the scan takes about 15 minutes, so save your work first.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Access your website securely from any location
When you work on the domain, site, blog, or different project that requires constant management, content creation, or coding, you may need to connect to the server and content management service more often. The best solution for creating a tighter network could be a dedicated/fixed IP address.
If you make your IP address static and set to your device, you can connect to the CMS from any location and do not create any additional issues for the server or network manager that needs to monitor connections and activities. VPN software providers like can help you with such settings and offer the option to control the online reputation and manage projects easily from any part of the world.
Recover files after data-affecting malware attacks
While much of the data can be accidentally deleted due to various reasons, malware is one of the main culprits that can cause loss of pictures, documents, videos, and other important files.
More serious malware infections lead to significant data loss when your documents, system files, and images get encrypted. In particular, ransomware is is a type of malware that focuses on such functions, so your files become useless without an ability to access them.
Even though there is little to no possibility to recover after file-locking threats, some applications have features for data recovery in the system. In some cases, can also help to recover at least some portion of your data after data-locking virus infection or general cyber infection.
From our report of May 2022 · not reviewed since
How to avoid being scammed
Spam campaigns are extremely prevalent due to malware-infected machines that form a so-called botnet.
Unknowingly to those affected, their computers automatically send out phishing messages to hundreds of other victims. In some rare cases, phishing emails are sent out by humans, too, although this usually manifests as a targeted attack against an organization or a business rather than a regular computer user.
Here are some tips that should help you from being tricked by scams similar to Microsoft Account Deactivation:
- Look at the sender's email - it is often not what you might expect to receive from an official company account.
- The sender's email might be similar to an official one or might be deliberately misspelled.
- An email address might also be spoofed, so you should still be skeptical, even if the address is legitimate.
- Look for grammar and spelling mistakes, formatting failures, and similar.
- If the email ends in the Junk email section, delete it immediately without interacting.
From our report of May 2022 · not reviewed since
What to do next?
First of all, please do not interact with the email - do not click any links or download software if offered.
You can easily expose your personal information to cybercriminals, resulting in further phishing attacks or even identity fraud. Likewise, links on spam emails might lead to malicious websites where malware could be downloaded and installed.
If you have unfortunately interacted with the email, such as clicked links and disclosed your personal information, you could expect to receive more phishing attempts coming your way. For example, you might receive more emails or phone calls that would include your personal details - be wary.
If something is indeed found, it will be deleted immediately. Using is also beneficial in such cases, as you could fix any system damage that could have occurred due to infection.
We also recommend reporting the incident to your local authorities that deal with fraud. You might find the following links useful:
If your country is not listed above, you should contact the local police department or communications center.
- USA - Internet Crime Complaint Center IC3
- United Kingdom - ActionFraud
- Canada - Canadian Anti-Fraud Centre
- Australia - ScamWatch
- New Zealand - ConsumerProtection
- Germany - Polizei
- France - Ministère de l'Intérieur
Questions about Microsoft Account Deactivation e-mail scam
Is the Microsoft Account Deactivation email real?
No. The Microsoft Account Deactivation email is a phishing scam. It falsely claims Microsoft received a request to deactivate your account and warns that deletion will occur within seven days. The email is designed to panic you into clicking a fake 'Verify Account' link.
Legitimate Microsoft does not send such warnings via email. Real Microsoft account team emails come from @accountprotection.microsoft.com, not no-reply@microsoft.com. If you receive this email, delete it immediately without clicking any links or downloading attachments.
What does the Microsoft Account Deactivation email want from me?
The email wants you to click the 'Verify Account' link, which redirects you to a fake spoofing website that looks identical to Microsoft's official page. On this fake site, you are asked to enter your Microsoft account username and password.
Scammers collect this information and use it to access your real account, steal data, reset your password, and lock you out of your own account. They may also use your credentials for identity theft or sell the information to other criminals. Never enter personal information into links provided in unsolicited emails.
What should I do if I receive the Microsoft Account Deactivation email?
Delete the email immediately without interacting with it. Do not click any links, download any files, or call any phone numbers mentioned in the message. Mark the email as spam in your email client so similar messages are automatically filtered in the future.
If the email landed in your normal inbox rather than spam, configure your email provider's filters to catch similar phishing attempts. Do not reply to the email or acknowledge it in any way. Simply delete and move on.
What happens if I click the 'Verify Account' link?
Clicking the link redirects you to a spoofing website that impersonates Microsoft's official account verification page. The fake site looks visually identical to the real Microsoft page, making it difficult to distinguish. If you enter your username and password, scammers capture your credentials immediately.
They can then log into your real Microsoft account, access your email, files stored in OneDrive, and any connected services. Your account can be locked, your payment methods stolen, and your personal data compromised. Never enter credentials on pages accessed through email links.
Is my Microsoft account actually being deactivated?
No. Your Microsoft account is not being deactivated. This is a false claim designed to create urgency and panic you into acting quickly without thinking carefully. Microsoft never deactivates accounts via email warnings.
If your account were actually being deactivated for a legitimate reason, Microsoft would contact you through official channels and provide multiple opportunities to verify the request through your actual account settings. There is no deactivation request—this is purely a scam tactic.
Where should legitimate Microsoft account emails come from?
Legitimate emails from Microsoft's account team use the email address @accountprotection.microsoft.com, not no-reply@microsoft.com. This is the official domain for account security notifications. If you receive a suspicious email claiming to be from Microsoft but using a different address, it is definitely phishing.
Even emails from @microsoft.com or @microsoftonline.com should be verified with caution. When in doubt, log into your account directly through the official Microsoft website rather than clicking email links. Do not trust email addresses that seem official but differ slightly from the correct domain.
What should I do if I already entered my password on the fake website?
Change your Microsoft password immediately using a different device that has not been compromised. Go directly to account.microsoft.com and update your password to something completely new that you have not used before.
Enable two-factor authentication if not already active. Review your account security settings and check for unauthorized sign-ins or connected apps. Contact Microsoft support to report the compromise.
Monitor your email, OneDrive, and any linked services for suspicious activity. Change passwords for any other accounts using the same or similar passwords. Consider running antivirus scans on all devices you used to access the fake website.
Should I report the Microsoft Account Deactivation phishing email?
Yes. Report the phishing email to Microsoft and your local authorities. Forward the email to Microsoft Phishing Report at reportphishing@microsoft.com or report it through your email provider's abuse reporting system.
In the United States, report to the Internet Crime Complaint Center (IC3) at ic3.gov. Canada: Canadian Anti-Fraud Centre (antifraudcentre.ca). France: Ministère de l'Intérieur.
Other countries should contact local law enforcement or their national cyber crime agency. Reporting helps authorities track phishing campaigns and take action against scammers.
Will Fortect remove Microsoft Account Deactivation?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Microsoft Account Deactivation, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Kaspersky: What is Spoofing – Definition and Explanation (read October 5, 2026)
- Wikipedia: Phishing (read October 5, 2026)
- Malwarebytes: What is a botnet? (read October 5, 2026)
- FTC: How to recognize and avoid phishing scams (read October 5, 2026)
- CISA: Recognize and report phishing (read October 5, 2026)