SENDER CHECK - MICROSOFT IMPERSONATION

Is [email protected] real? Wrong question, and scammers know it.

People search this address after finding it in an email footer, usually under a prize announcement and Microsoft's Redmond street address. The address is not the tell. The same year, spam went out from a Microsoft address that was completely genuine.

SB

SafeBrowz Threat Research Security Research · 17 August 2026 · 8 min read

Why so many people search this exact address

The searches arrive in a pattern: the address, then fragments of an email footer, Microsoft Way, Redmond, sometimes discount percentages. That is someone holding a suspicious email and pasting its pieces into a search bar, hoping the internet will rule on it.

It is a sensible instinct, and it does not work here. The literal string "Mail at [email protected]" shows up on scraped junk pages and puzzle-solver sites rather than anywhere official, so the search returns noise. A fact-check of the phrase in March 2026 reached the same conclusion: the web trail for this address proves nothing in either direction. The email in your inbox is the only evidence that matters, and it usually decides the question in seconds.

The email that footer usually belongs to

The classic carrier is the Microsoft lottery email, a genre that has circulated for well over a decade and still arrives in inboxes today. An example posted to Microsoft's own Q&A forum in early 2025 announced a prize of $375,000 plus two phones, selected "through electronic balloting" from email addresses the winner never submitted, complete with batch numbers, reference numbers, and Microsoft's real street address in its letterhead. The address it told the winner to write to was microsoftcorpdept[.]com, which is not Microsoft.

Three sentences in that email do all the work, and they appear in every version of it. There is a prize. You were entered into a draw you never joined. You must keep the win confidential. That last one is the most honest sentence a scammer ever writes: the secrecy is not to protect your prize, it is to keep you away from anyone who would tell you it is a scam before the "processing fee" gets paid.

The footer exists to answer the doubt the body creates. A street address you can look up, a corporate-sounding mailbox, a batch number - each one is checkable-looking rather than checkable. Microsoft's postal address is public information; printing it proves the scammer owns a keyboard.

The uncomfortable half: a real Microsoft address sent spam too

If the rule you take away is "check whether the sender domain is really microsoft.com", 2026 broke that rule in public. In May, TechCrunch reported that scammers had spent months sending spam through [email protected], the genuine Microsoft address that delivers two-factor codes and critical account alerts. The Spamhaus Project confirmed it had watched the same address pushing spam for months. The messages carried scam links, and the sender line passed every test, because it was real.

That is the same lesson as the fake Bank of America email that installed remote access, approached from the opposite side: there, a lookalike domain read as real at a glance; here, the real domain genuinely was real and the email was still hostile. The sender line can fail you in both directions.

Microsoft's addresses are worth knowing anyway. Genuine account mail comes from domains like microsoft.com, microsoftonline.com and accountprotection.microsoft.com, and those are real infrastructure, not scams. The point is narrower: a match tells you the mail passed through Microsoft's systems, not that a human at Microsoft wants you to click the link inside it.

Sixty seconds with the email itself

• Read the claims, not the letterhead. A prize you did not enter, a draw run over email, a request for secrecy - any one of these ends the question regardless of who sent it. Microsoft runs no email lottery. Nobody does.
• Check where the links go before anything else. Copy the link without clicking it and check the destination before your browser ever goes there. That destination is the one part of the email the sender cannot dress up, which is why it settles the real-address cases too.
• Treat the footer as decoration. Street addresses, mailboxes like [email protected], batch numbers and reference codes cost a scammer nothing. They are set dressing, not evidence.
• Verify through the front door. If the email claims something about your account, sign in at the service directly, typed or from a bookmark. A real alert will be waiting there; a fake one will not exist. Our guide on checking whether an email address is real walks the general method.

When the sender line cannot be trusted either way

This is an awkward scam class for advice, because the two usual instincts both fail. "Look for a fake domain" misses the abused real address. "Trust the real domain" misses it too. What remains reliable is behaviour: what the email asks for, and where its links lead.

That second part is what SafeBrowz is built around. Layer 1 reads the shape of a link in the browser before anything loads. Layer 2 checks the destination against reputation feeds, our brand database of over 550 names and our blocklist. Layer 3 runs AI content analysis on the page the link actually opens, which is the layer that catches a scam page sitting behind a perfectly legitimate-looking email. The prize-scam sender above is flagged by the brand layer today; you can test it by clicking the red address in this article.

Honest scope: we judge links and the pages behind them. An email with no link at all, one that just asks you to reply, has nothing for a scanner to scan, and the sixty-second checklist above is the defence that covers it.