Windows Security · Accounts & Sign-In Security · Lesson 5 of 5

Challenge: The 2 AM Account Alert

Help Dana calmly check a late-night account alert and lock her account down.

The email at 2 AM

Your neighbor Dana knocks on your door in the morning, holding her phone. At 2 AM she got an email titled "Unusual sign-in activity" for her Microsoft account. It has a big blue button that says Review recent activity.

A few minutes later, a second email arrived. It holds a password reset code. Dana never asked to reset anything.

She is scared and wants to tap the button right away. You know that real Microsoft alerts exist, but scammers copy them perfectly. The look of an email proves nothing.

So the safe move is the same either way. Don't use the email's button or links. Open the browser and go to the account page yourself, by typing the address.

A reset she didn't ask for

The reset code email means someone typed Dana's email address on the password reset page. That alone doesn't let them in. They still need the code, and it went to Dana.

An hour later, Dana's phone rings. A man says he is from Microsoft support. He says a hacker is in her account, and he needs the code from her email to stop it.

Microsoft never calls to ask for a code. Whoever has the code can reset the password.

What the activity page shows

Dana signs in at account.microsoft.com and opens Security, then her sign-in activity. Most entries are her own laptop and phone, in her own town.

But at 1:52 AM there is a successful sign-in from a country she has never visited. She doesn't use a VPN. Someone really did get in, probably with a password she reused on another site.

Before signing anyone out, she needs to take away the one thing the intruder is using to get in.

Locking it down for good

Dana now has a new, long password she has never used before. Next she chooses Sign out everywhere, and turns on two-step verification with the Authenticator app.

Then she checks her recovery info. Her phone number is there. So is a backup email she has never seen before.

Finally, she adds a passkey, so that next time she can sign in with Windows Hello.