You open your inbox and there it is: a stark, unstyled email from [email protected] telling you that someone signed into your Microsoft account from a country you've never been to. Or it's [email protected] warning that a new device just accessed your Gmail. Or it's a noreply Amazon address in Japanese saying your Prime is about to renew. Three thoughts arrive in roughly this order: is this real, what happens if I ignore it, and what happens if I click.
Search interest for exactly these questions is at a five-year high. The Google Trends data for "noreply" hit a fresh peak in early 2026, and the rising queries underneath are dominated by specific account-security addresses: [email protected], [email protected], [email protected]. The reason they're rising is that all three are being actively abused right now, and the surface differences between a real one and a fake one are smaller than ever.
This is a recipient's field guide: how to tell the real ones apart from the fakes in 2026, why the old advice ("check the sender domain") is no longer enough, and what to do when you genuinely can't tell.
Why "just check the domain" stopped working
The traditional checklist for spotting a phishing email — look at the sender domain, hover over links, watch for typos — was built for an era when scammers couldn't actually send mail from a real @microsoft.com or @google.com address. That era is over.
Two recent attacks made the point.
The DKIM replay attack on Google. In April 2025, security researchers documented a phishing campaign that delivered fully DKIM-signed messages from the genuine address [email protected]. The mechanic: an attacker registered an OAuth app inside their own Google account with the phishing pitch baked into the app name, triggering a real Google security alert email sent to themselves. Because the cryptographic signature covers the body but not the recipient list or send time, the attacker could then forward that signed message to thousands of victims without breaking the signature. SPF, DKIM, and DMARC all passed. Gmail showed it as authenticated. The sender field was real.
Microsoft's accountprotection.microsoft.com abuse. In May 2026, TechCrunch reported that scammers had been exploiting a Microsoft internal account for months to send spam links from a domain Microsoft itself uses for legitimate two-factor codes and password-change confirmations. The from address — the same one millions of users have been trained to trust — was the real one.
The implication for everyone outside security teams is that the "is the sender domain right?" question is now necessary but not sufficient. A perfectly aligned, fully authenticated noreply email from a Fortune 500 domain can still be a scam. You have to look at what it's asking you to do.
One point of confusion worth clearing up first: "noreply" is not a company, a service, or a website. There is no noreply.com to log into and no "noreply" account to access. It is just a naming convention — a mailbox prefix companies use for automated mail they don't monitor for replies. Every sender attaches it to their own domain (noreply@, no-reply@, notify-noreply@, microsoft-noreply@), which is exactly why the domain after the @ sign, not the word "noreply", is what tells you who actually sent the message.
The high-volume noreply addresses people are searching right now
Each of the most-Googled noreply addresses is legitimate for one narrow purpose, and that purpose is the key to spotting impostors.
| Address | What it's legitimately used for | Common scam pattern |
|---|---|---|
[email protected] | 2FA codes, password-change confirmations, unusual sign-in alerts for Microsoft / Outlook / Xbox accounts | Fake "your account will be closed" pressure, spam links smuggled through the real address, lookalike domains like accountprotection.microsoft.com.xyz |
[email protected] | General Microsoft account and product notifications — receipts, subscription and rewards updates | Spoofed "security alerts" from this address; real Microsoft security mail comes from the accountprotection.microsoft.com address above, so a sign-in warning from the generic address is itself a red flag |
[email protected] | Security alerts, new device sign-ins, password resets for Google / Gmail / Workspace | DKIM-replayed "subpoena" or "legal hold" messages linking to sites.google.com phishing pages |
[email protected] / [email protected] | Order confirmations, shipping notices, Prime renewals | Fake renewal/payment-problem emails using lookalike domains (amaz0n.co.jp, amazon-billing.com), "your account is on hold" pressure |
Notice what the legitimate uses have in common: every one of them is a passive notification or one-time code. Microsoft uses the account-security address to tell you something happened, never to ask you to act on it through a link in the email. Google's [email protected] sends 2FA codes and sign-in alerts, never invoices or subpoenas. Amazon's noreply addresses confirm orders and shipping, never ask you to "verify your payment method" through an embedded link.
That asymmetry is the most reliable signal you have.
The 2026 verification checklist
Run any noreply email through these checks in order. The first one that fails ends the decision.
1. Does it ask you to do anything urgent? Real noreply messages from Microsoft, Google, and Amazon are almost always informational. "Here's your code." "We noticed a new sign-in." "Your order has shipped." If the email is pressuring you — "verify in 24 hours or your account will be suspended," "click here to confirm payment," "legal action will proceed" — it's almost certainly a scam, regardless of who it appears to be from. Legitimate security teams do not threaten you in transactional email.
2. Does it ask for credentials, payment info, or codes? Microsoft, Google, and Amazon will never ask you to enter your password through an email link. They will never ask you to "confirm" a 2FA code you didn't request. They will never email you a link to update billing details. The legitimate flow is always: you go to the site yourself, log in, update what needs updating. A noreply email asking for any of this is fake even if every header checks out.
3. What's the actual link destination? Hover (don't click) and read the URL bar. A genuine Microsoft email will link to microsoft.com, live.com, or office.com. A genuine Google email links to google.com or accounts.google.com. A genuine Amazon email links to amazon.com or your country's Amazon domain. If the link goes to microsoft-verify.com, google-secure.net, amazon-prime-billing.co, or any URL shortener, stop. The DKIM-replay attack on Google in particular routed victims to a sites.google.com page — technically a Google domain, but the actual destination was attacker-controlled content. If the URL looks unusual for that vendor's normal pattern, treat it as hostile.
4. Did you do something to trigger it? A real noreply alert almost always corresponds to an action you took or one you can verify. A Microsoft sign-in alert should match a device you actually used. An Amazon shipping notice should match an order you actually placed. A Google "new device" alert should match logging in on a new computer. If the email refers to an action you didn't take, the answer isn't to click the "this wasn't me" link in the email — it's to go to the vendor's site directly and check.
5. Verify through the source, never the email. This is the universal escape hatch. Open a new tab, type microsoft.com / google.com / amazon.com by hand, log in, and look. Every legitimate noreply alert from these vendors will have a corresponding entry in your account: Microsoft's recent activity, Google's security checkup, Amazon's order history or message center. If the email exists but the in-account record doesn't, the email is fake.
This last step is the one to drill into a habit, because it's the only check that works even when the email is technically authentic — as it was in the Google DKIM-replay case.
What to do when it's a scam
Don't reply. Don't click "unsubscribe" (real phishing emails treat the unsubscribe link as a confirmation of a working address). Don't forward it to friends with a warning — that just spreads the embedded links.
Report it through the vendor's own channel:
- Microsoft: forward to
[email protected], then delete. - Google / Gmail: open the message, click the three-dot menu, choose "Report phishing."
- Amazon: forward as an attachment to
[email protected], then delete.
If you already clicked, the order of operations is: change the relevant password from a known-clean device, enable 2FA if it wasn't already on, then check the account's recent activity and authorized devices for anything you don't recognize.
What this means for businesses sending noreply email
If you're on the sending side of any of this — confirming orders, sending receipts, dispatching account alerts — the rise in noreply phishing is your problem too. Every legitimate noreply email you send is a template a scammer can clone, and every customer who got burned by a fake will be slower to trust the real one. The damage is asymmetric: one bad day from impersonators can erode trust your real transactional email has built over years.
There are two things that genuinely help. The first is technical: getting your DMARC policy to p=reject so unauthenticated mail from your domain can't reach inboxes at all. That doesn't stop lookalike domains, but it kills direct spoofing of your real one. The second is behavioral: training customers, over thousands of legitimate touches, to recognize what your real noreply emails do and don't ask them to do.
The behavioral side is where most senders give up, because it sounds like "send fewer emails" — which they can't. But it's actually about consistency. If every real noreply email from your company routes customers to exactly one place when they have a question, your customers learn that pattern. The phishing emails — which inevitably link to fake login pages or payment forms — start to feel obviously wrong.
This is the inverse of the brand-side noreply problem: instead of asking how to capture the replies customers send to noreply addresses, you're asking how to give them such a clear, consistent, branded path to action that the fake versions can't compete. Both moves point to the same destination — a single, owned, trustworthy channel attached to every real email you send.
Phishing is a trust problem, and trust is built channel by channel. The brands that come out of 2026 looking good are the ones whose customers know — by habit, by repetition, by consistency — exactly which channel is theirs and which one isn't.
No credit card required.
