Email Scam - "Verify Account" - How to remove

The “verify account” email scam is a malicious attack that uses deceptive emails and fake login sites to steal login credentials.

Did you get an email telling you to “upgrade” your email account and threatening that it’ll be shut down if you don’t? That’s the first step of the “verify account” email scam.

The scam has nothing to do with Microsoft. It’s malicious actors pretending to be Microsoft and sending people scary emails with links to phishing sites.

About the “verify account” email scam:

Type of threat	Phishing scam.
How the “verify account” spreads	It comes in emails that are designed to look like they’re from Microsoft, the spam emails threaten that your account will be shut down if you don’t “upgrade” it immediately.
Dangers posed by the phishing scam	Hacked, stolen email and other accounts, your contacts receiving malicious messages, more malicious messages in the future.
How to protect yourself from the “verify account” scam	Learn about phishing emails, use multi-factor authentication, protect your computer from spyware and other malware with antivirus tools (Spyhunter for PC, Combo Cleaner for Mac).

Anatomy of the Verify Account email scam

“Click here to upgrade”

Users on the Answers.microsoft.com forum talked about receiving strange emails urging them to “upgrade” their email account or risk it being shut down.

Here’s the text of the email:

Microsoft new update

Check your Mailbox account now because the old version will be shutting down on [tomorrow’s date].

ClickHere [link to a fake Microsoft site] to upgrade

Important: Failure to comply within 48hrs might lead to permanent shut-down.

Thank You. Please do not reply to this message. Mail sent to this address cannot be answered

The users who described the phishing scam were rightfully suspicious: Is this a scam?, Received strange email copied below. The Microsoft email verification emails are similar to the Account Closure and Account Shutdown emails that were harassing Outlook users a couple of years ago. Threats to create a sense of urgency are typical for scams.

Fake Microsoft login sites

These fake account verification emails have one link to a page that attempts to impersonate Microsoft. This page has a button that says:

Click here to verify account

Clicking on that opens yet another fake Microsoft page, this time with a fake Sign in form. This form asks for your email and password, then sends them off to whoever created the webpage. After that, the Verify account email scam sends you to a real Outlook page.

And that’s it – there’s no account shutdown, no upgrade. The goal of the “verify account” email scam is to gather people’s sign in details. They can be sold and used to hack accounts.

Dangers posed by the “verify account” email scam

The people who spread the “verify account” email scam want to collect people’s emails and passwords. They can then use these passwords to make money:

• they could sell the data to other cybercriminals,
• they could try the stolen credentials on other popular websites (lots of people reuse the same passwords on multiple websites) and hack those accounts,
• they could use the hacked accounts for ad fraud, they could sell them, spread scams to their contacts, purchase items, etc.,
• criminals could use stolen data to perform a targeted phishing attack.

The goal of the people who made the “verify account” email scam is to make money, but it’s not always obvious how they might do it.

How to avoid the “verify account” email scam

Protect your password from the “verify account” scam

If you fell for the “verify account” scam and did reveal your password and email on the fake login sites, there are two things you should do:

• reset your password (and make sure to use a strong and unique one),
• make sure that you have multi-factor authentication on (this will make it much harder for anyone to hack your accounts).

It would also be good to make sure that you’re computer is protected with antivirus security and is free of spyware infections.

Recognize phishing emails

Learn to spot phishing messages. Microsoft has its own advice – to watch out for urgency, suspicious links, generic greetings, etc. (Protect yourself from phishing). There’s also this great article on Digitalcheck that can be extremely helpful.

If you have any doubts, make a post on Answers.microsoft.com or another forum. Ask people for advice, just like those people who reported the Verify account email scam did.

Avoid malware

There are a few ways to deal with scams and malicious websites. You could use an ad blocker or a malicious site blocker to try and stop phishing sites from appearing. However, all those fake pages that aided the Verify account email scam were hosted on legitimate content management systems (WordPress, Weebly). Since these sites are trustworthy, they can’t be blocked easily. Besides, the malicious actors can easily set up new pages.

Use antivirus apps, such as Spyhunter for Windows or Combo Cleaner for macOS to protect your devices from malicious files. Because although the “verify account” email scam carried only a phishing link, some malicious emails carry serious malware – trojan droppers for spyware and ransomware. They usually come in Word documents and PDFs, although just about any file type can be used.

Automatic Malware removal tools