Protect yourself from phishing

Phishing tries to make you sign in on a fake page or hand a code to someone on the phone. The page can look exact. The clue is how you got there and what they ask next.

• Type the site address yourself or use a bookmark. Do not follow a “verify your account” link from an unexpected message.
• Check the domain before you enter a password. A real Microsoft sign-in uses a Microsoft domain, not a lookalike with extra words.
• Hang up if a caller already knows your name and says your account was charged, then asks you to install software or buy a gift card.
• Turn on two-step verification so a stolen password is not enough.

Microsoft does not call people out of the blue to fix a virus, and does not ask for payment in gift cards, wire transfers, or cryptocurrency.