Subject: Unusual sign-in activity - verify now
From: "Account Security" <no-reply@microsft-account-verify.com>

Dear user,

We detected unusual activity on your account. A login attempt from an
unknown device was blocked. Your account will be suspended within 24
hours unless you verify your identity immediately.

Click the link and enter your password plus the OTP verification code:
http://microsft-account-verify.com/login?session=ae91

Failure to verify will result in permanent account closure and your
funds will be held for 90 days.

Account Security Team
