Fake quarantine notification emails: how to tell a real quarantine notice from phishing

"You have 6 messages held in quarantine. Release them before they are deleted." Real filters do send notices like this, which is exactly why phishers copy them. A fake quarantine notification uses the look of a spam-filter digest to send you to a fake sign-in page. This guide shows how real Microsoft 365, Google Workspace and filtering-service notices work, how the fakes differ, and what to do if you clicked.

What is a fake quarantine notification email?

A fake quarantine notification is a phishing email that pretends your spam filter is holding messages for you and asks you to click a button such as Release, Review messages or Deliver pending mail. The button leads to a fake sign-in page that captures your email password, and often your MFA code or session. Some versions copy Microsoft 365's notification layout; others pretend to come from your own IT team, your web host or "Email Administrator."

The lure works because a quarantine is a real thing most people half understand. A quarantine is a holding area where a spam filter keeps suspicious messages instead of delivering them; our guide to what an email quarantine is explains how it works. People have learned that real mail sometimes ends up there, so a message saying "you have held mail" feels routine and worth acting on.

Typical fake subject lines include:

• "You have 7 new messages in quarantine"
• "Release pending incoming messages"
• "Incoming emails failed to deliver: action required"
• "Mailbox notice: messages held for review"
• "Spam notification: 4 messages awaiting your approval"

Each adds a deadline, such as messages being deleted in 24 hours, to stop you from checking.

Watch the sender, too. Attackers who take over a mailbox often use it to phish the owner's colleagues and contacts; Microsoft described one campaign in which a hijacked account sent over 600 phishing emails. A quarantine notice that arrives from a colleague's address, rather than from your filter, is a strong sign that account has been compromised.

Why do fake quarantine emails work so well?

Fake quarantine emails work because they turn a safety feature into the lure. People are told that real mail sometimes gets caught by the spam filter, so a notice offering to rescue it sounds helpful rather than risky. The messages listed are chosen to matter: payments, signed agreements, voicemails and tax documents. And the action asked for, signing in to release mail, is something a real quarantine portal may also ask you to do. The difference is where you sign in, which is why the checks below focus on opening the portal yourself instead of judging the email's design.

What do real Microsoft 365 quarantine notifications look like?

Real Microsoft 365 quarantine notifications list each held message and offer a few fixed actions, and they only arrive if your admin has turned them on. Microsoft documents the format on Microsoft Learn:

• Sender: by default, quarantine@messaging.microsoft.com. Admins can choose an existing internal user as the sender instead, and can add a company logo, a custom sender display name, a custom subject and a disclaimer of up to 200 characters in up to three languages (Microsoft Learn).
• Contents: for each message, the Sender, the Subject and the Date it was quarantined, in UTC.
• Actions: Review message is always present. Release, Request release and Block Sender appear only if the quarantine policy grants them.
• Where Review message goes: the message's details in the Microsoft Defender portal quarantine, the same view as https://security.microsoft.com/quarantine?viewid=Email.
• Frequency: every four hours, daily or weekly, set by your admin.

Three details are useful when you're judging a notice:

1. Notifications are off unless your admin turned them on. Microsoft says notifications "aren't turned on" in the default AdminOnlyAccessPolicy or DefaultFullAccessPolicy. They're on in DefaultFullAccessWithNotificationPolicy, used by preset security policies, in NotificationEnabledPolicy if your organization has it, and in custom policies that turn them on. If your organization has never sent you one, a sudden notice deserves suspicion.
2. Some messages can't be released by users at all. Recipients "can't release" messages quarantined as malware, or as high confidence phishing by anti-spam policies; they can only request release. A notice urging you to release a "virus-scanned invoice" yourself doesn't match how Microsoft 365 works.
3. Releasing doesn't need a separate login page. In a real notice, Review message opens the Microsoft Defender portal, and Release or Request release opens a short Microsoft confirmation page. If you aren't signed in, you sign in through Microsoft's normal sign-in page.

What about Google Workspace and Gmail?

Google Workspace doesn't send quarantine notifications to ordinary users. Google says "recipients are never notified when a message is quarantined" and that periodic notifications are "sent only to super admins," with "a maximum of 1 notification per hour" (Google Workspace Admin Help). Gmail's admin quarantine is reviewed by admins in the Admin console. Our guide to the Google Workspace admin quarantine covers how it works.

So if you use Gmail or Google Workspace and get an email saying messages are held in your quarantine, it is fake, unless your company also uses a separate email filtering service that sends its own digests. Ask your IT team which, if any, they use.

What about digests from an email filtering service?

Many businesses route mail through a filtering service in front of Microsoft 365 or Google Workspace, and those services often send their own quarantine digests. iBlockSpam, for example, gives every user a personal quarantine with scheduled digest emails (hourly, daily, on a chosen weekday or on a custom schedule) and gives admins a domain-wide shared quarantine; see quarantine and digests.

Because these digests are legitimate, they're also worth copying for an attacker. The safe habit is the same for any provider: know what your real digest looks like, and if in doubt, open the quarantine from a bookmark or the provider's portal rather than from the email. If a held message isn't there, the email was fake.

How do I tell a real quarantine notice from a fake one?

Compare the notice with what your real filter sends, and verify by going to the quarantine yourself. This table summarizes the differences:

The FTC's advice applies directly: if you get an unexpected message asking you to click a link, check it by contacting the company "using a phone number or website you know is real."

How do I check a quarantine notice safely?

1. Don't click anything in the email. Leave it in your inbox for now.
2. Open your quarantine directly. For Microsoft 365, type security.microsoft.com/quarantine into your browser or use a bookmark (Microsoft Learn). For a filtering service, use its portal bookmark. Google Workspace users have no personal quarantine to check.
3. Look for the listed messages. If they're there, deal with them in the portal, not from the email. If they aren't, the notice was fake.
4. Check the sender's real address if you want extra confirmation. Our Email Header Analyzer shows the actual sending domain and whether SPF, DKIM and DMARC passed. How to read email headers explains the fields.
5. Report it. Use the report button in Outlook or Gmail; see how to report a phishing email.
6. Ask IT if you're unsure. Admins can see whether a real notice was sent and whether the messages exist.

Here's an invented example of a fake notice, for illustration only:

Example of a fake quarantine notice (not a real message): From: "yourcompany.com Mail Admin" <noreply@mail-quarantine-center.example> Subject: [Action Required] 5 incoming messages held for you@yourcompany.com

The following messages are pending delivery and will be deleted in 24 hours:

1. Payment Advice – Remittance #4471
2. Signed agreement (DocuSign)
3. Voicemail from +1 (555) 0100

[Release all messages] [Review messages]

The display name borrows the recipient's domain, the sender is unrelated, and the messages are generic money and document lures. The buttons lead to a sign-in page that is not Microsoft's.

What should I do if I entered my password on a fake quarantine page?

Treat your account as compromised and act straight away, because the attacker may sign in within minutes.

1. Change your password from a trusted device, by typing the sign-in address yourself.
2. Tell your IT team so they can revoke your sessions, remove any MFA method or inbox rule the attacker added, and check sent mail. Many fake sign-in pages capture the session as well as the password; see adversary-in-the-middle phishing.
3. Watch for follow-up phishing sent from your account to colleagues or customers.

The full checklist is in what to do after clicking a phishing link.

What should admins do about fake quarantine notifications?

Admins should make the real notices recognizable, teach users the "open the portal yourself" habit, and remove the fakes quickly. At the time of writing (November 2026), these steps apply.

1. Brand your real notices. In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Quarantine policies (in the Rules section), select Global settings, and set Use my company logo, a sender display name, subject and disclaimer (Microsoft Learn). Microsoft makes the same point about Safe Links warning pages: branding helps users identify legitimate warnings "because default Microsoft warning pages are often used by attackers" (Microsoft Learn). Our quarantine policies guide covers every setting.
2. Tell staff what the real ones look like. Send a short note with a screenshot of your genuine notice or digest, its sender, its schedule and the portal address.
3. Protect your own domain from spoofing. Fakes that use your exact domain as the sender are stopped by DMARC enforcement; see stop email spoofing of your domain. Fakes that only borrow your name in the display name need user awareness and filtering; see display name spoofing.
4. Purge and block. When a fake is reported, remove every copy and block the URL; see remove a phishing email from all mailboxes and block a sender or domain in Microsoft 365.
5. Check for compromised accounts among anyone who clicked, starting with sign-in logs and new inbox rules.

Next steps

• Find out which quarantine notices your organization really sends, if any, and bookmark the portal you'd use to check them.
• Brand Microsoft 365 quarantine notifications with your logo and a disclaimer, and show staff an example.
• Make "open the quarantine yourself" the rule for every held-mail email.
• If you want users to have a personal quarantine with digests on a schedule you choose, see iBlockSpam's quarantine and digests; the free Email Header Analyzer checks where any suspicious notice really came from.

Browse our other phishing and threat guides.