I receive an email daily from [PII: Removed]@aol.com pretending to be from Microsoft

Question

I would like to prevent emails from @aol addresses that pretend to be from Microsoft, from reaching my hotmail/outlook inbox. Every day a different email address arrives e.g. "[PII : Removed]@aol.com" or "[PII : Removed]@aol.com" to "[PII : Removed]@communication.com", subject [PII : Removed].

Then the message might say:

"We informed you last month to let you be aware of the changes we have implemented to our Privacy Policy and Terms of Service. These changes are crucial steps in creating a future for all of our clients, including you, while granting them transparency and choice over how their data is used.  

To continue using your mailbox[PII : Removed] you have to verify that you accept the terms of service.

To continue using your account without interruption, please review and accept our updated Oath Terms of Service by clicking the following link:  

CONTINUE HERE"

I don't click on the link. This is obviously a phishing scam, but how do people (or bots) manage to send such emails, and how can it be stopped. Surely Microsoft themselves should be able to accomplish the task.

Thank you for your attention.

---

Moved from Microsoft Teams | Microsoft Teams for business | Other

Answer 1

Hi Chris Trotter

I hope you are doing well ! I just want to check if you have had a chance to test the steps earlier? Please let me know if they helped resolve the issue or if you are still experiencing any difficulties. I am here to assist you further.

Best Regards

Answer 2

Dear Chris Trotter

Please note that our forum is a public platform, and we will modify your question to hide your personal information in the description. Kindly ensure that you hide any personal or organizational information the next time you post an error or other details to protect personal data.    

Thank you for reaching out to the Microsoft Q&A forum. I understand you are having problem with recurring phishing emails from varying @aol.com senders that impersonate Microsoft and arrive in your Outlook.com/Hotmail inbox with subjects like “Mailbox Update Required”, prompting you to click a link. I am happy to assist you. Please follow these steps:  

1. Block the entire sender domain instead of individual addresses. Block email addresses or domains, so messages are automatically moved to Junk Email. Please add the domain “aol.com” to the blocked list. 
2. Create an inbox rule to auto-handle recurring phishing patterns. If the sender domain varies or spoofing occurs, rules can act on subject keywords like “Mailbox Update Required” and move/delete the message automatically. Create a rule with a condition matching the subject phrase and an action to move to Junk or a dedicated folder for review.  
3. Report each message as phishing to improve Microsoft filtering. With the message selected, use Report > Report phishing. If using Outlook mobile, see How do I report phishing or junk email? - Microsoft Support 
4. If you suspect any account compromise, force sign-out everywhere. Use “Sign out everywhere” under Advanced security options.  

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".  

Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

Answer 3

To prevent phishing emails from reaching your Hotmail/Outlook inbox, you can take the following steps:

1. Report Phishing Emails: Use the built-in reporting feature in Outlook. When you receive a suspicious email, select it and click on the "Report" option. This helps Microsoft improve their filtering systems.
2. Block Senders: You can block specific email addresses or domains. In Outlook, go to "Settings" > "View all Outlook settings" > "Mail" > "Junk email". Here, you can add the domains (like @aol.com) to the blocked senders list.
3. Use Filters: Create a rule to automatically delete or move emails from certain senders or with specific keywords in the subject line to the Junk folder. This can help manage unwanted emails effectively.
4. Enable Enhanced Security Features: Ensure that you have enabled all security features available in your Microsoft account, such as two-factor authentication, which can help protect your account from unauthorized access.
5. Educate Yourself on Phishing: Familiarize yourself with common phishing tactics. Recognizing the signs of phishing can help you avoid falling victim to such scams in the future.

While Microsoft employs various anti-phishing technologies to protect users, some phishing attempts may still get through. Regularly updating your security settings and being vigilant can significantly reduce the chances of receiving such emails.

---

References:

• How Microsoft 365 validates the From address to prevent phishing
• Anti-spoofing protection for cloud mailboxes