I got an email with reference number

Do not use the email’s link; sign in to your Microsoft account independently, review Recent activity, and report the message as phishing if no matching phone-number change appears.

Verify whether the change happened

1. Open a new browser window and manually type: https://account.microsoft.com
2. Sign in, open Security, and select Review activity.
3. Look for entries such as Phone number added, Phone number deleted, or other security-information changes. Expand anything unfamiliar:
   • Under Unusual activity, select This wasn’t me.
   • Under Recent activity, select Secure your account.
4. If an unauthorized event appears, change your password from the Security basics page and review the listed security methods.

Microsoft’s Recent activity page covers the previous 30 days and specifically identifies phone-number additions and deletions. It does not display every account event, so no matching entry strongly suggests that the email is fraudulent or unrelated, but is not absolute proof.^1^

Since your account information is still correct, do not change the password solely because the email arrived. Change it if you find unauthorized activity or another indication that someone accessed the account.

Check the sender without trusting the email

Microsoft account notifications, including account-update messages, use the domain:

@accountprotection.microsoft.com

Unusual-activity alerts may come from:

[Email]

Check the complete sender address, not only the displayed sender name. Microsoft documents that account-team notifications from the @accountprotection.microsoft.com domain are legitimate.^2^^3^

However, a visible From address can be spoofed. The independent account-activity check is more useful than trusting the displayed sender or the reference number. Microsoft’s consumer guidance verifies these alerts through sender details and account activity; it does not provide a reference-number lookup procedure.

Report the message

• Outlook.com or Microsoft 365 Outlook: Select the message without opening its links, then choose Report → Report phishing. This reports it to Microsoft and removes it from the Inbox.^4^
• Another email application: Create a new email to [Email] and attach the original suspicious message. Do not simply forward it, because Microsoft needs the original message headers.^5^
• After reporting it, delete the message. Do not reply, call any number in it, open attachments, or click its links.

Because you did not click the link and your account information remains correct, the immediate actions are to check Recent activity and report/delete the email.

References

1. What is the Recent activity page? | Microsoft Support
2. Can I trust email from the Microsoft account team? | Microsoft Support
3. What happens if there's an unusual sign-in to your account | Microsoft Support
4. Phishing and suspicious behavior in Outlook | Microsoft Support
5. Protect yourself from phishing