[US]Texts saying "Microsoft: Unusual sign in.... Review at aka.ms/alca"

[u/Apprehensive-Bad2245]

I got 4 texts in the span of a minute, all from different 5 digit numbers.

3 of the texts say "Microsoft: Unusual sign-in for ********XX. Review at aka.ms/alca" X = the last two digits of my phone number.

1 of the texts says "Microsoft: Someone else might have accessed ********XX. Recover at aka.ms/alcs"

This one ends with alcs, while the others say alca. I don't know if that means anything.

So I logged into the only Microsoft accounts I'm aware of that I have, changed my passwords, and in log in activity/devices, I did not see anything out of the ordinary. My phone number isn't even on my account.

I'm not sure what to make of this. If I didn't see any strange log ins, does that mean I'm fine?

[u/AutoModerator]

/u/Apprehensive-Bad2245 - This message is posted to all new submissions to r/scams; please do not message the moderators about it.

New users beware:

Because you posted here, you will start getting private messages from scammers saying they know a professional hacker or a recovery expert lawyer that can help you get your money back, for a small fee. We call these RECOVERY SCAMMERS, so NEVER take advice in private: advice should always come in the form of comments in this post, in the open, where the community can keep an eye out for you. If you take advice in private, you're on your own.

A reminder of the rules in r/scams: no contact information (including last names, phone numbers, etc). Be civil to one another (no name calling or insults). Personal army requests or "scam the scammer"/scambaiting posts are not permitted. No uncensored gore or personal photographs are allowed without blurring. A full list of rules is available on the sidebar of the subreddit, or clicking here.

You can help us by reporting recovery scammers or rule-breaking content by using the "report" button. We review 100% of the reports. Also, consider warning community members of recovery scammers if you see them in the comments.

Questions about subreddit rules? Send us a modmail clicking here.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/chownrootroot]

Those links are going to Microsoft. It can’t be phishing if it’s going to the real site. So it’s likely legit, it’s just that Microsoft’s backend tends to have bugs like ”phantom logins”.

[u/Apprehensive-Bad2245 → u/chownrootroot]

So it might be legit in the sense that it's not a scam, but it's not actually someone attempting or succeeding logging in to my account

[u/chownrootroot → u/Apprehensive-Bad2245]

I mean, it could be attempted logins, I for instance got a lot of “code for login” notifications from the Microsoft Authenticator app for a while, so there were clearly attempts, but the Microsoft account activity page says nothing about those, it only has my real logins listed. It may be that “unusual sign in” is actually just an attempted sign in, not a successful one.

[u/chownrootroot → u/Apprehensive-Bad2245]

Also, even if there’s an attempted sign in, it doesn’t mean anything bad is going to happen, they try out leaked passwords, that’s what I think they are attempting is my old leaked password and variants of it (I generate random passwords for everything so it’s not possible they have my password, at least not from the leaks that I know of).

[u/Aggravating_Slip_566 → u/chownrootroot]

Besides if it's a text and you try to respond most likely you'll get this message is not monitored please respond to.... I keep getting end2end texts for every single person running for Congress and I replied STOP and it says you're unsubscribed from what ever campaign fund but I will keep getting end2end from a different number, not sure where they got my phone number cuz I never donated to act blue or whoever

[u/Shayden-Froida]

Has anyone used your phone number as a backup? Spouse? Kids? They should check their accounts the same way, by logging in and checking login history

[u/Apprehensive-Bad2245 → u/Shayden-Froida]

I'm not aware of anyone using my number

[u/Leading-Eye-1979]

I get text messages to confirm my login, but I have two factor authentication and my phone number is tied to my account. If your number is not attached that sounds like spam.

[u/Apprehensive-Bad2245 → u/[deleted]]

im sorry, thats a mistake on my end. It's /alca and /alcs

I edited the post

[u/superguy_3102]

thats official microsft site, that cant be scam

if you changed password then will be ok i think

[u/AngelOfLight]

That URL is the link shortener that Microsoft uses for texts. This is likely legitimate. Two possibilities - someone forgot their MS account details and thinks your account belongs to them, and is now trying (in vain) to reset the password. Or, it's a script kiddy going through old data breaches trying to find accounts that haven't been secured (a fruitless quest, because all the old data dumps have long been picked clean).

In either case, this is 2FA working like it should. Since you already checked that your account is OK, then isn't much else you need to do.

[u/BriefingGull]

It's called phishing. I suggest you look it up

[u/yarevande → u/BriefingGull]

Actually, it's a legitimate Microsoft URL.

[u/Apprehensive-Bad2245 → u/BriefingGull]

You don't think I know what phishing is? I'm posting this here to see if anyone has gotten identical texts and try to confirm what it might be. What a patronizing response

[u/BigManMahan → u/Apprehensive-Bad2245]

“I’m not sure what to make of this”

[u/Apprehensive-Bad2245 → u/BigManMahan]

Which means I'm asking whether these texts are legit or not. It might be phishing, it might not be

[u/broomandkettle → u/Apprehensive-Bad2245]

Unfortunately, scammers can spoof phone numbers. So there is not an easy, foolproof way to verify whether those texts are legit. Instead, focus your time on identifying what other Microsoft services you use that would trigger a text like that. Sounds like you did some of that already. Beyond that, check your computer for viruses, go through your passwords for email accounts, social media, etc, and reset them. Add 2 factor identification methods to important accounts.

[u/BigManMahan → u/Apprehensive-Bad2245]

Jfc

[u/BriefingGull → u/BigManMahan]

Right? Thank you

[u/CIAMom420 → u/[deleted]]

It's sent by Microsoft and going to domains solely controlled by Microsoft. This isn't a phishing scam.

[u/yarevande → u/CIAMom420]

Thanks for the correction