Today I got a warning from Microsoft saying that there was unusual activity on my account. Diving deeper I saw that there was a successful sign in from a Google owned IP address (according to ARIN). However, I use Two-Factor Authentication (Both on my Microsoft and Google account) and they were stopped at the token challenge. The weird thing is, I never gave Google my password for my Microsoft Account. I did give google an Application Password so that Gmail can use my live account, however these passwords bypass the authentication, leading me to think that they used my actual password.

The Security Details

In the account activity section on my Microsoft account, I can see all of the POP3 logins that Google is using, which is to be expected, and if I force replication of my account through gmail it does not get denied.

My question's are: If this was Google, how in the world did they get my password? Or is this somebody who is spoofing their IP address to look like Google? And what course of action should I take? I've set a new password, and regenerated all of my application passwords, should I do anything else?

closed as primarily opinion-based by TildalWave, Xander, John Deters, Eric G, Steve May 14 '14 at 19:59

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I got the same message today, twice.. I just assumed it's gmail, as my account history is full of POP3 access from google. Perhaps Microsoft has changed some security setting that is now triggering an alert for something which it used to ignore. Pretty annoying. – jsj May 14 '14 at 0:59
  • Annoying indeed. I'm going to assume that it was a bug in Microsoft's servers that caused it to trigger a security challenge for an app password when it shouldn't have. – ecnepsnai May 14 '14 at 1:01
  • I want to mention: gmail don't have the functionality to import mails from external accounts by pop3. It had to be some other problem, in this case I see google spying very improbable. – peterh May 14 '14 at 12:08
  • 1
    Why is this closed as opinion-based? Anyway, this happened to me because I had POP3 download set up on my Gmail account. The solution for me was to go into my Microsoft account settings, set my gmail account as my "primary alias", then remove my old Microsoft email address alias because I never used it anyway. :P – CullenJ Jul 13 '14 at 6:19
  • 1
    I'd also like to know, but I just accepted its fate. Hasn't reoccured. – ecnepsnai Jul 13 '14 at 6:24