Why Did I Get a "Service Deactivation" Email? A Guide to Phishing Scams

Receiving an email that claims your account will be deactivated is a common and frightening experience. It's designed to create a sense of panic, prompting you to act without thinking and, in doing so, give away your personal information to criminals.

The sender’s address was a jumbled mess of characters, far from the professional polish you’d expect from Microsoft. This is a textbook example of a phishing scam, and it’s one that UK businesses and individuals need to be on high alert for. In this blog, we’ll dissect this scam, explain why it’s dangerous, and share practical tips to protect yourself.

This article will break down the specific email you shared, explain why it's fake, and provide a clear guide on how to protect yourself from similar threats.

Phishing email

What is the "Service Deactivation" Email and Why is it a Phishing Scam?

The email, which appears to be from "IT-Support" and addresses a "deactivation request," is a malicious message designed to steal your credentials. It is not from Microsoft or any legitimate service provider.

Let's examine the specific elements of this email and compare them with how a real company like Microsoft communicates.

The Email: A Closer Look

The email in question came from a bizarre sender address:

IT-Support 601NotificationExchangeSever8OU2MTRMD3FR6OC8YH3U <ByrnesupportDocsxsz5s2Jw8RqgzzUWYyB81MpZ/...>

It claimed that a deactivation request had been approved and included a “Confirm Access” link to cancel it. The message was brief, urgent, and lacked personalisation, addressing the recipient simply as “dev.” It bore Microsoft’s branding, complete with the company’s Redmond address, but the red flags were glaring.

Why This Is a Phishing Scam

Phishing scams are designed to trick you into revealing sensitive information like login credentials or financial details by posing as a trusted entity. Here’s why this email screams “scam”:

1. Dodgy Sender Address: Legitimate Microsoft emails come from clear, recognisable domains like @microsoft.com or @accountprotection.microsoft.com. The sender’s address in this case was a chaotic string of letters and numbers, a tactic scammers use to hide their true identity.

2. Urgent and Vague Language: The email’s warning about “service deactivation” and the call to “Confirm Access” are classic phishing ploys. They create panic, pushing you to act quickly without thinking. Microsoft would never send such a vague, alarmist message without specific details about your account.

3. Suspicious Link: The “Confirm Access” link is a trap. Clicking it likely leads to a fake website mimicking Microsoft’s login page, designed to steal your credentials or infect your device with malware. Always hover over links (without clicking) to check the URL, legitimate ones point to microsoft.com or office.com.

4. Lack of Personalisation: The email used the name in small caps as a greeting, likely pulled from the email address. Genuine Microsoft communications often include your full name or specific account details, especially for business accounts.

5. Poor Formatting and Tone: While not riddled with spelling errors, the email’s sparse structure and awkward phrasing (e.g., “Proceed to confirm access below to cancel deactivation if not requested”) lack the professional polish of Microsoft’s official correspondence.

6. Fake Microsoft Branding: Including Microsoft’s name and address is a common trick to make scams look authentic. But branding alone doesn’t mean it’s legit—scammers rely on this to exploit trust.
   

The Bigger Picture: Phishing in 2025

This isn’t an isolated incident. Phishing scams targeting Microsoft 365 users are on the rise in 2025, with cybercriminals getting craftier. Some scams even misuse legitimate Microsoft infrastructure, like billing notifications, to seem authentic. Others, like this one, rely on forged emails to lure users into clicking malicious links. UK businesses, in particular, are prime targets due to their reliance on Microsoft 365 for cloud-based operations. Falling for such a scam could lead to stolen credentials, data breaches, or even ransomware attacks, costing time, money, and reputation.

How to Protect Yourself

Don’t let scammers catch you off guard. Here’s how to stay safe:

1. Don’t Click Suspicious Links: Never click links in unsolicited emails, especially those urging immediate action. If you’re worried about your account, go directly to admin.microsoft.com or account.microsoft.com to check for issues.

2. Verify the Sender: Check the email address carefully. If it’s not from a recognisable Microsoft domain, mark it as spam and report it.

3. Enable Multi-Factor Authentication (MFA): MFA adds an extra layer of security, making it harder for scammers to access your account even if they steal your password.

4. Report Phishing Attempts: Forward suspicious emails to reportphish@office365.microsoft.com or use the Microsoft 365 Defender portal. You can also mark the email as junk in your email client.

5. Check Your Account Directly: If you receive a worrying email, log in to your Microsoft 365 admin centre or contact Microsoft support via support.microsoft.com. Never use contact details provided in the email.

6. Strengthen Email Security: For businesses, ensure your email system uses SPF, DKIM, and DMARC to filter out phishing attempts. Regularly train staff to spot scams.

7. Act Fast if Compromised: If you’ve clicked a link or entered details, change your password immediately and enable MFA. Contact your IT team if it’s a business account.

What to Do if You Receive This Email

If you’ve received an email like the one described, here’s your action plan:

• Don’t click the “Confirm Access” link. It’s likely a gateway to trouble.

• Check your Microsoft 365 account directly to confirm there’s no deactivation request.

• Report the email to Microsoft and your email provider.

• Warn colleagues or friends if you’re part of a business or shared network, as scammers often target multiple users.

The email claiming a “service deactivation request” is a phishing scam, plain and simple. Its suspicious sender address, urgent tone, and dodgy link are designed to trick you into compromising your Microsoft 365 account. In 2025, phishing scams are more sophisticated than ever, but with vigilance and a few simple checks, you can stay one step ahead. Always verify unexpected emails, avoid clicking unknown links, and keep your account security tight. If you’re ever in doubt, go straight to Microsoft’s official channels to confirm.

Stay safe, and don’t let the scammers win!