Microsoft account hacked: clean-up and recovery in Microsoft's order

How can you tell an Outlook or Hotmail account was hacked?

A hacked account usually shows itself through changes you did not make. The password suddenly stops working, a confirmation email arrives for a password change you never asked for, or friends receive messages you never wrote. Any one of these means the intruder may still be inside.

For Outlook mailboxes in Microsoft 365, the official list of hack symptoms is more specific. Look for inbox rules that forward mail to unknown addresses or move it to Notes, Junk Email or RSS Subscriptions. Odd messages in Sent Items, such as a plea for money from someone stuck abroad, frequent password changes and unexplained lockouts point the same way.

For example, a forwarding rule to 1 unknown address keeps copying every new email out of the hacked Microsoft account until you delete it. Check Settings, Mail, Forwarding in Outlook.com after the password change.

What should you do first if your account is hacked?

If your account is hacked, scan your PC for malware before you change the password, as the official guidance says. Open Windows Security, go to Virus and threat protection, then Scan options, Full scan and Scan now. Any updated antivirus works.

Only then change the password to a strong one the hacker cannot guess, or reset it if the old one stopped working. Microsoft resets some settings after a hack, so check connected accounts, forwarding and automatic replies in Outlook.com next. A forwarding rule the hacker left behind can keep copying your mail out after the password change.

A full scan in Windows Security can take more than an hour. Microsoft Defender Offline, under Scan options, restarts the PC to catch threats that hide while Windows runs.

What if the hacker changed the email and security info?

When a hacker changes the email and security info, the Sign-in Helper at aka.ms/sign-in-helper is the first stop. It asks for the address or phone number you sign in with, then shows self-help or offers the chance to talk to an agent. If it cannot undo the hacker's changes, the account recovery guide walks through the recovery form.

What if an Outlook mailbox in Microsoft 365 was hacked?

A hacked work mailbox in Microsoft 365 is handled by the admin, and the official playbook starts by disabling the user account during the investigation. Failing that, the admin resets the password. The new password should never go to the user by email, because the attacker may still read that mailbox.

Next comes a sweep for anything the attacker planted. The admin revokes active sign-in sessions, removes unknown multifactor devices, reviews apps the user consented to and checks admin roles. Mail forwarders and inbox rules get the same review. Then multifactor authentication gets enforced.

What goes wrong when a hacker gets back in?

A hacker can return to a recovered account through something left behind. A new password typed on an infected PC, a forwarding rule nobody checked or a trusted device that was never removed all reopen the door. Hijacked mailboxes can also keep a fake email signature, such as a bogus banking or prescription drug signature, so delete anything you did not create.

Reused passwords are the other gap. After the cleanup, turn on two-step verification with three pieces of security info, as the two-step verification guide explains. Keep public numbers off an account won back from a hacker. Use your own phone or a private number (coming soon), since anyone can open a public line's page; public Microsoft lines fit throwaway test logins only.

Secure a hacked Microsoft account in Microsoft's order

1. Run a full scanIn Windows Security, open Virus and threat protection, then Scan options, Full scan and Scan now.
2. Change the passwordSign in and set a new strong password, or reset it if the old one stopped working.
3. Check mail settingsReview connected accounts, forwarding and automatic replies in Outlook.com.
4. Judge recent activityMark unfamiliar events This wasn't me and update your security info.
5. Close old sessionsRemove all trusted devices, then turn on two-step verification.