I received 2 different emails from ******@messaging.microsoft.com: 1) Sell me knee braces & 2) Saying my cloud storage is 100% full.

Question

I received 2 different emails from ******@messaging.microsoft.com: 1) Sell me knee braces & 2) Saying my cloud storage is 100% full.

I was going to block the emails' sender's address BUT, I thought maybe Microsoft is having trouble making money so Microsoft is selling knee braces now.

I used my outlook email's feature to right click on the messages to see where they are from.

The emails are in my "deleted" folder for now.

Answer 1

Hello,

I suggest checking the email header or message source, specifically the SPF, DKIM, and DMARC results, to see whether they passed.

If any of them failed, the sender address may have been spoofed. The header can often reveal the actual sending domain or server.

If they all passed, the email may have been sent through a legitimate Microsoft notification system. For example, Microsoft may send a notification that you missed a message someone sent through Teams. However, while the notification email itself is delivered by Microsoft, the message content may have been created by another user and does not necessarily come from Microsoft.

I have seen scammers take advantage of legitimate Microsoft notification systems. They may send content through Teams or subscribe someone’s email address to Power BI dashboard updates. In those cases, the email is genuinely delivered by Microsoft, but the content inside it is not Microsoft content and should not automatically be trusted.

Answer 2

Emails that:

1. Try to sell unrelated products (like knee braces), and
2. Claim that Microsoft cloud storage is 100% full,

are typical characteristics of spam or phishing, especially when combined in messages from the same apparent sender.

Key points based on Microsoft guidance:

• Outlook shows indicators for suspicious messages, such as:
  • A ? in the sender image when the sender cannot be authenticated.
  • A via tag showing that the actual sending domain differs from what appears in the From address.
• Not every unauthenticated message is malicious, but messages that look unusual, promote products, or mix marketing with account warnings should be treated with caution.
• Legitimate Microsoft account/storage notifications are about:
  • Cloud storage being full, which can prevent sending/receiving Outlook.com email and syncing OneDrive.
  • These are normally focused on account/storage information, not selling unrelated products.

Recommended actions:

1. Treat both emails as suspicious.
2. Do not click any links or open attachments in those messages.
3. Permanently delete them from the Deleted folder.
4. If Outlook shows them as junk or suspicious, report them as phishing/spam using Outlook’s built-in reporting options.
5. Independently check actual Microsoft storage status by signing in directly (not via email links) and reviewing the Microsoft storage area of the account dashboard, or checking OneDrive/Outlook.com storage pages.

If storage really were full, Outlook.com would stop sending/receiving email and OneDrive would stop accepting new files until storage is freed or more storage is purchased.

---

References:

• Phishing and suspicious behavior in Outlook
• Storage limits in Outlook.com
• Microsoft storage FAQs
• Changes to Microsoft 365 email features and storage