Today I got a warning from Microsoft saying that there was unusual activity on my account. Diving deeper I saw that there was a successful sign in from a Google owned IP address (according to ARIN). However, I use Two-Factor Authentication (Both on my Microsoft and Google account) and they were stopped at the token challenge. The weird thing is, I never gave Google my password for my Microsoft Account. I did give google an Application Password so that Gmail can use my live account, however these passwords bypass the authentication, leading me to think that they used my actual password.

The Security Details

In the account activity section on my Microsoft account, I can see all of the POP3 logins that Google is using, which is to be expected, and if I force replication of my account through gmail it does not get denied.

My question's are: If this was Google, how in the world did they get my password? Or is this somebody who is spoofing their IP address to look like Google? And what course of action should I take? I've set a new password, and regenerated all of my application passwords, should I do anything else?

  • I got the same message today, twice.. I just assumed it's gmail, as my account history is full of POP3 access from google. Perhaps Microsoft has changed some security setting that is now triggering an alert for something which it used to ignore. Pretty annoying.
    – jsj
    Commented May 14, 2014 at 0:59
  • Annoying indeed. I'm going to assume that it was a bug in Microsoft's servers that caused it to trigger a security challenge for an app password when it shouldn't have.
    – ecnepsnai
    Commented May 14, 2014 at 1:01
  • I want to mention: gmail don't have the functionality to import mails from external accounts by pop3. It had to be some other problem, in this case I see google spying very improbable.
    – peterh
    Commented May 14, 2014 at 12:08
  • 1
    Why is this closed as opinion-based? Anyway, this happened to me because I had POP3 download set up on my Gmail account. The solution for me was to go into my Microsoft account settings, set my gmail account as my "primary alias", then remove my old Microsoft email address alias because I never used it anyway. :P Commented Jul 13, 2014 at 6:19
  • 1
    I'd also like to know, but I just accepted its fate. Hasn't reoccured.
    – ecnepsnai
    Commented Jul 13, 2014 at 6:24


Browse other questions tagged .