This was a simulated phishing test

What just happened

The "Microsoft security" email you received was not from Microsoft. It was a safe, internal phishing simulation run by our security team. If you clicked the link and entered your credentials, no real account was compromised and no password was stored. But had this been a real attack, an outsider could now have access to your account.

The good news: this is exactly the moment to learn the warning signs so the real thing does not catch you.

Red flags you can catch next time

• The sender address. Real Microsoft alerts come from microsoft.com domains. Hover over the sender and check the full address, not just the display name.
• The link destination. Hover over any button or link before clicking. The real Microsoft sign-in is login.microsoftonline.com. Anything else is suspect.
• Urgency and deadlines. "Verify within 24 hours or lose access" is pressure designed to make you act before you think.
• Unexpected sign-in alerts. If you get a security warning you were not expecting, go directly to the service yourself instead of clicking the email link.
• Requests to re-enter your password. Legitimate services rarely email you a link asking you to log in to "confirm" your identity.

What to do when you spot one

• Do not click links or open attachments.
• Report it using the Report Phishing button in Outlook, or forward it to the IT/Security team.
• If you already entered your password anywhere suspicious, change it immediately and tell IT.
• When in doubt, ask. It is always better to check than to click.