recovery methods

Question

Recently and when signing into my email, the system persistently prompts me to review my recovery methods.

Is this a legit request from Microsoft?

Answer 1

If you sign into https://account.live.com or www.outlook.com for example and you receive the pop up, then yes, it is typically legitimate.

Microsoft does remind users to review their security info from time to time, because users might change their internet provider and have different email address, or change phone and need new authentication app installed on new phone, etc. Such reminder is meant to make sure their security info is up to date so users won't get locked out. You can always manually check by going to https://account.live.com > Security > Manage how i sign in.

Answer 2

A prompt shown while signing in to Outlook.com asking you to review recovery methods can be legitimate, but verify it by opening Microsoft’s account dashboard yourself rather than following links in an email or unexpected pop-up.

Verify and update the recovery methods safely

1. Open a new browser tab and manually enter https://account.microsoft.com.
2. Sign in and select Security.
3. Review your security information, including the alternate email address, mobile number, and other verification methods.
4. Keep methods you recognize and can still access. Add a current method before removing an obsolete one.
5. Do not remove or replace every recovery method simultaneously; changing all security information can restrict the account for 30 days.^1^

Microsoft occasionally asks users to check their security information—for example, after they have not signed in for some time. A “make sure you can receive a security code” notice can initially be skipped for 24 hours at a time, but Microsoft may require verification or new security information after seven days.^1^

Signs that the prompt may be unsafe

Stop and close the page if:

• The browser’s sign-in address does not include login.live.com.
• It asks you to email or disclose your current password. Microsoft states that it will never request your password by email.
• The recovery phone number or email shown is not yours.
• The prompt came from an unsolicited email and its link leads somewhere other than a Microsoft site.

Microsoft recommends adding alternate contact information because it can help restore access if an Outlook.com account is compromised.^2^

If you see unfamiliar information or activity

From Microsoft account → Security, select Review activity:

• For activity in Unusual activity, expand it and select This wasn’t me.
• For unfamiliar entries under recent activity, select Secure your account.
• If someone may have accessed the account, return to Security and change the password.^3^

If an offered recovery address or phone number is unfamiliar, first check that the complete Outlook/Hotmail address—including its country domain—is correct. If it is your account but none of the recovery methods are accessible, select I don’t have any of these during verification and follow the account-recovery prompts.^1^

---

References

1. Troubleshoot Microsoft verification code issues | Microsoft Support
2. Help protect your Outlook.com email account | Microsoft Support
3. What happens if there's an unusual sign-in to your account | Microsoft Support