In addition, it doesn’t hurt to scan your computer for signs of viruses, or potentially even restore your Windows computer to factory settings. Tap or click here to see how to generate stronger passwords. Try to create new passwords that are much harder to guess, so any hackers with access to your account will be caught flatfooted. If you already made the mistake of clicking the link, you’ll need to get in touch with Microsoft to reset your passwords immediately. It’s absolutely worth doing and can save you hours of heartbreak (and your personal data, potentially). If you get an email with the subject line “Recent Policy Change,” and if the sender field features the word “security” in the sender’s email address, ignore it! These are the biggest red flags for the scam.īut while you’re at it, make a habit of checking the sender field of every single email you receive. This is where it says “From:” followed by the sender’s email address.

Just like with most phishing emails that claim to come from an “official source,” the whole narrative falls apart as soon as you take a peek at the sender field of the email. And because the ad is hosted by a legitimate faction (Google), it can easily pass spam detection filters. In order for the “ad” to even function, this means the hackers behind the campaign spent real money to set the page up. This scam is unusual for several reasons, but the most notable one is how it harnesses the power of Google Ad Services to fly under the radar. But after spending less than a moment on the “ad,” the page redirects you to a fake Microsoft Office login.Īnd yes, you guessed it, this fake login page is where the hackers steal your information. This isn’t abnormal, as Google is responsible for hosting millions of ads across the internet. When you click on the link from the email, you’re redirected to what appears to be an ad hosted by Google itself. Hilariously, clicking on either button takes you to the same phishing site.īut here’s where things get weird. Below this “urgent” notice, two buttons labeled “Accept” and “Learn More” are available for victims to click on. In the email’s body, victims will get instructions telling them to agree to updated terms of service and privacy policy, or else risk losing access to Microsoft Office. The sender email, however, will usually contain the word “security” to make it seem more authentic. Here’s how it works: Victims receive a high-priority email in their inbox with the subject line “Recent Policy Change.” The email, in most cases, purports to be from Microsoft, but a quick glance at the sender field shows you that isn’t the case.

Microsoft account security alert