I keep getting Emails from Microsoft about a KQL Database.

Question

I in no way purchased this, and why am I getting it from MS as a charge to a PayPal account? I have no PayPal account. Here is the email address used. **microsoft-noreply@microsoft.com, ****@molly.s08.usa1.teams-events.com with titles like this Areeba Khan shared this KQL Database with you. lina lina shared this KQL Database with you. You’re registered for Your PayPal account has been charged $449.99 (0.0076) BTC today. Your Order ID number is: JYGYG545. If you did not approve this transaction, please contact us immediately at +1 (803) 525-4853 to cancel this subscription or request... lina lina shared this KQL Database with you

Microsoft Subscription Payment Reminder

Dear Customer, This is a friendly reminder regarding your recent order. Invoice ID: INV-PLPY626T Product: Microsoft 365 Business Standard (1-Year Subscription) – $612.23 USD Payment Method: PayPal Order Date: March 2, 2026 Due Date: March 4, 2026 If payment has been made, please disregard this notice. You can cancel or modify your plan anytime. For help, contact our Customer Support. : +1.803-525.4595 I can't block an MS email, or I'll get no notification from MS. MS needs to do something about this.

Answer 1

Hello

The email address itself is a legitimate Microsoft address, but the content is not.

Here is how the scam works: the scammer creates a database or a file, and used the share feature. The share feature then sends an automated notification from its official system, which makes the email address appear “Microsoft sent this.” Basically the scammers control the content shared, but it was delivered in official channel.

Please do not fall for it. Don't call or engage. Just delete the email.

Answer 2

Those emails describe classic phishing and fraud attempts, not legitimate Microsoft billing or PayPal charges.

Key points from the details provided:

1. The content is typical scam language
   • Threats like “Your PayPal account has been charged $449.99… If you did not approve this transaction, please contact us immediately…” are standard phishing tactics to make the recipient call a fake “support” number.
   • The Bitcoin (BTC) reference and urgent cancellation phone numbers are also strong indicators of fraud.
   • Misspellings, odd formatting, and generic greetings like “Dear Customer” are common in scams.
2. Legitimate Microsoft account/billing emails
   • Legitimate security/account notices for Microsoft consumer accounts typically come from domains like @accountprotection.microsoft.com, as noted in the context. Messages that do not come from such domains and that ask to call a phone number or urgently “upgrade” or “pay” are highly suspect.
   • A similar example in the context (“As part of our system updates… your account may be deactivated…”) was confirmed as phishing because it did not come from a correct Microsoft domain.
3. What to do with these emails
   • Do not call the phone numbers in the emails.
   • Do not click any links or open attachments in those messages.
   • Treat them as phishing and delete them.
   • In Outlook.com or Outlook, mark them as junk/phishing so the service can improve filtering.
4. About blocking Microsoft senders
   • It is not necessary to block all Microsoft addresses. Instead, block or mark as junk only the specific scam messages/domains that are clearly not from official Microsoft security/billing domains.
   • For ongoing issues with unwanted or suspicious email in Outlook.com, use the in-product Help option to contact support if needed. The context explicitly points to using the Outlook.com help channel for additional assistance.
5. If there is concern about real charges
   • If any actual charge appears on a bank or card statement, use the official Microsoft account pages and the “Investigate” option described in the billing article, not links or phone numbers from the suspicious emails.
   • For suspected fraud charges on a Microsoft account, the recommended path in similar cases is to contact Microsoft support through official channels (for example, the “Get Help” app or support site) and remove any unauthorized payment methods.

In summary, the emails described are phishing scams impersonating Microsoft and PayPal. They should be deleted and reported as junk/phishing, and any real billing concerns should be handled only through official Microsoft and bank/PayPal sites, never via the phone numbers or links in those messages.

---

References:

• Receiving email from blocked senders in Outlook.com
• Avoid and report Microsoft technical support scams
• How to investigate a billing charge from Microsoft
• Unable to cancel your Microsoft subscription
• Troubleshoot payment option issues
• Is this legit email also? - Microsoft Q&A
• Email from M!CROSOFT - Microsoft Q&A
• fraud charges on microsoft account - Microsoft Q&A