1. Do not click links, open attachments, or reply to the email.
2. In Outlook, use Report → Report phishing (or forward the message as an attachment to support).
3. If you already clicked a link or entered your password: change your password now at https://aka.ms/sspr and tell support immediately so we can check for sign-ins and mail rules.
4. Delete the message. We will block the sender and remove copies from other mailboxes.