CUSTOMER:

Hi I received an email from Microsoft account team <account-security-

noreply@accountprotection.microsoft.com> in relation to Password reset code at 15:15 AEST - 2nd May
2018. The email was sent to my backup email account at thomasck@gmail.com

I have not requested to reset my password throughout the day. could you please advise if there is
anything I need to do to protect my outlook.com account? Is there anything I need to worry about?

Thanks
Thomas

Hello Thomas,

Thank you for reaching out to us. My name is Richard and I am happy to be of help. I have gone through
your email and it appears that you recently received an email indicating the recent changes being
implemented to your account such as changing your account password. No worries, we will sure look
into this concern on your behalf.

Firstly, if you have recently change any personal information from your account, you should also receive
the notification from your own personal account. In addition, may we know if you can still access the
account in question using your old password?

Also, may we request for a screenshot and message header of the email notification that you received?
Detailed steps on how to get the message source is indicated below:

1. Sign in to https://outlook.live.com (using computer browser)

2. Right click the email and click “View message source”
3. Copy all details on the “Message source” box and include it as you reply to us.
Please see screenshots for reference.

If you are worried and thinking if someone else is accessing your account and could have change some
information, we highly recommend you to check your recent activity. Through checking your recent
activity, we can verify if there are unusual sign in recorded to your account. To proceed, please follow
the steps below:

1. Login to http://account.microsoft.com/
2. Go to Security Tab
3. Review Recent Activity
4. Check if there is unknown sign-in logs/location

If you found anything unusual, we suggest you to update your password. Here’s is a link you can click
that will direct you to the change password page: http://account.live.com/pw

We look forward to your reply. Have a pleasant day, Thomas!

Sincerely,
Richard T.,Outlook.com Support

CUSTOMER:

Hi

sorry was a bit busy. the password reset email was sent to my gmail account.

I believe the following is what you needed me to provide?

I have checked recent account activity and couldn't find anything suspicious on the day I received the
email below.

Delivered-To: thomasck@gmail.com
Received: by 10.176.90.17 with SMTP id l17csp310456uad;
Tue, 1 May 2018 22:15:42 -0700 (PDT)
X-Google-Smtp-Source:
AB8JxZpsfcufE/blQCWnXh4YsQ/nxFy5E7WfxKlBfldp5spI+0vAc5S5b0kl+9o+H1ur84vSQf7p
X-Received: by 10.167.131.92 with SMTP id z28mr18129079pfm.237.1525238142233;
Tue, 01 May 2018 22:15:42 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1525238142; cv=none;
d=google.com; s=arc-20160816;
b=MvmJPe/QJJkbdrrRLsmldDG29SqLkfeNfpQpEDsiJecULJvel/dp75+QWYZCFaAcvm
5la8FEuxGIJO+BcMrhm9mcJyZo2he4JKHFcgklH+VtBocO4wgkBA99DL06E163HvUTba
5RwJVQmw2FXelnrrrWceNvdfJKB17HqP8iLWFtrncVlDUuQehtRshKjsP/2nkLUDpJ6D
c6nZrFYo8gSECQzXS0g+3oBsJu9ugvLkNgxUbhjrmdY0ayAUb1LrFywPTI5WRbAj/E5b
lgV/+zVX37b13qpsiCA8fdu/RHZWZh0a2ddwc77LKEZp9sc5uprGWHpBNAtyvnZDxmWX
r5GA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=spamdiagnosticmetadata:spamdiagnosticoutput:mime-version:message-id
:to:subject:date:from:dkim-signature:arc-authentication-results;
bh=2uw/kUl5N1jb/J6bOVWXsE5vyFq0FimPRzuRJ9UEa58=;
b=sUpoX/yWfg7scU+xB3j077hxlny3c9OPbtWnFfoIoL7ZCuwziyW103qaYmnW6GOH+j
fmZk7stu20mmgYYWtGGIOtCQuylMHdnQMjW5Oq3IgRMjDPAqlemBXjzrlPERKwGjJE8u
n9JywM8sUhexLErNvk0RIxC6PaieDbizlu8bPml8mYiCHuGf3CVlNpJtSixwHTdLORzi
jeaahEtC8CIaJC30BgEECwGmRrTTVYCcdPKD+GGJatFQCPad0dmEgx5A8DuTcmYdOcmD
KR3TOAJ5ZIY5+D1y/LE9KCJi9Tiv6SDRmQLcm7pweuBN8P35omzG1Bs0C0O/Vp/VFHjw
l8wQ==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@accountprotection.microsoft.com header.s=selector1 header.b=QUpBYUkC;
spf=pass (google.com: domain of account-security-noreply@accountprotection.microsoft.com
designates 104.47.42.54 as permitted sender) smtp.mailfrom=account-security-
noreply@accountprotection.microsoft.com;
dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=accountprotection.microsoft.com
Return-Path: <account-security-noreply@accountprotection.microsoft.com>
Received: from NAM03-BY2-obe.outbound.protection.outlook.com (mail-
by2nam03on0054.outbound.protection.outlook.com. [104.47.42.54])
by mx.google.com with ESMTPS id x15-v6si8636036pgq.442.2018.05.01.22.15.42
for <thomasck@gmail.com>
(version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128);
Tue, 01 May 2018 22:15:42 -0700 (PDT)
Received-SPF: pass (google.com: domain of account-security-noreply@accountprotection.microsoft.com
designates 104.47.42.54 as permitted sender) client-ip=104.47.42.54;
Authentication-Results: mx.google.com;
dkim=pass header.i=@accountprotection.microsoft.com header.s=selector1 header.b=QUpBYUkC;
spf=pass (google.com: domain of account-security-noreply@accountprotection.microsoft.com
designates 104.47.42.54 as permitted sender) smtp.mailfrom=account-security-
noreply@accountprotection.microsoft.com;
dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=accountprotection.microsoft.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=accountprotection.microsoft.com;
s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version;
bh=2uw/kUl5N1jb/J6bOVWXsE5vyFq0FimPRzuRJ9UEa58=;
b=QUpBYUkCqWhTmHqAIkJ78IeAORWXDkyx7fCXQlMyWLGiDu/st1kh7Il4A0bg70J7xRHxy1tZoYHWZVhu
sz7/Tos/AQkSN7Z/0smBVaukpsg+Pmk5A8uAZQTi4ndXbeOgN+0SFDDcr7cwiyoHrb8hkacL1KqIz1jUVer9s
Afl43w=
Received: from CO1NAM03FT054.eop-NAM03.prod.protection.outlook.com (10.152.80.52) by
CO1NAM03HT044.eop-NAM03.prod.protection.outlook.com (10.152.81.208) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.20.696.11;
Wed, 2 May 2018 05:15:41 +0000
Received-SPF: Pass (protection.outlook.com: domain of accountprotection.microsoft.com designates
157.55.103.193 as permitted sender) receiver=protection.outlook.com; client-ip=157.55.103.193;
helo=accountprotection.microsoft.com;
Received: from accountprotection.microsoft.com (157.55.103.193) by
CO1NAM03FT054.mail.protection.outlook.com (10.152.81.181) with Microsoft SMTP Server
(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.715.13 via
Frontend Transport; Wed, 2 May 2018 05:15:41 +0000

Hello Thomas,

Thank you for patiently waiting to our reply. We will further investigate about the message header you
have provided. Also, may we request for the screenshot of the email you received please? You can use
Snipping tool for capturing the screenshot, detailed steps are indicated through this link:
https://support.microsoft.com/en-us/help/13776/windows-use-snipping-tool-to-capture-screenshots.

We look forward to receive the screenshot. Thank you so much, Thomas. Have a pleasant day!
Sincerely,
Richard T.,Outlook.com Support

CUSTOMER:

Hi Richard

didn't know about this snipping tool. very useful. I have always been using MIcrosoft Paint...

anyway attached is the screenshot of the email I received on my gmail account.

Thanks

Thomas

Hello Thomas,

Thank you for patiently waiting to our reply. We have confirmed that the email notification you receive
regarding the change password request is a legitimate email. Your Gmail account could be set up as your
security email address which means this is where you will receive verification codes every time you need
to authenticate your account especially when changing or adding information in your account.

If you receive this email, this means that someone had tried to change your password, however it was
not successful since they need to enter the code sent to your Gmail account. Since you have verified
that there is no suspicious activity when you check your recent activity, what we can only think is that
the person who tried to update your password is someone who has access to your device.

We don’t know the intention of the person who attempted to change your password, it may be
someone you personally know or it might be done accidentally. Moving forward, if you want to increase
your account security, we highly advise you to set up two steps verification. This will keep your account
secured from someone who is trying to get into your account. This feature will send codes to your
Mobile Phone every time you will access or there is someone who will attempt to login with your
account. Below are the steps that you could perform:

1. Login to https://account.microsoft.com/security
2. Select “more security options”.
3. Verify your Microsoft Account using your associated phone number or email address.
4. Under Two-step verification, choose “Set up two-step verification” and click “Next”.
5. Choose how do you want to verify your account if it was an app, phone number or alternate email
address enter the needed information on the textbox and click “Next”.
6. Verify your information you key in on the textbox and click “Next”.
7. Click “Next” again then “Finish”.

To know more about two steps verification security, you may visit this link:
https://support.microsoft.com/en-us/help/12408/microsoft-account-about-two-step-verification.

I hope that you’ll find the above information helpful. Should you need further assistance or you have
things to clarify, please do not hesitate to let us know. We are just here ready to help.

Thank you for your time and as always, have a pleasant day, Thomas!

Sincerely,
Richard T.,Outlook.com Support

__________________________________

Hello,

We noticed that you have not replied to our last email regarding this issue. You may be busy or have
missed our last correspondence. So, we thought of doing a quick follow up.

Please let me know if your issue is resolved. If your issue is not resolved and you need further assistance,
please reply to this email. We had asked for few more details to better understand the issue. If you can
provide those details, we can immediately start working on the resolution. Our goal is to ensure that
your experience with Outlook.com Support leaves you pleased with our product and services.

We would greatly appreciate if you can find time to get back to us.

Thank you for contacting Outlook.com Support.

Best regards,
Outlook.com Support

Hello,

We would like to bring to your attention that we have made multiple attempts to reach you to check the
status of your issue. As we have not heard back from you and this ticket has remained inactive for the
last few days, we believe that either your issue is now resolved or you are currently unavailable to work
on this issue. So, we would be archiving this ticket as of now. Please be assured that you can reopen this
ticket at your convenience by replying to this email or create a new ticket by using the “Help” (?) feature
of www.Outlook.com
Thank you for contacting Outlook.com Support.

Best regards,
Outlook.com Support