hotmail account comprimised

Question

hotmail account comprimised

Hannish Parayil Gopalakrishnan 20

Hi Team,

I am writing to report a security concern regarding my account. It appears the account has been compromised, as I have observed multiple unauthorized login attempts originating from various geographic regions.

I have already updated my password and enabled Multi-Factor Authentication (MFA); however, I am still receiving persistent "Approve Login" requests via my authenticator app. This suggests that the unauthorized parties may still have access to current credentials or are attempting an MFA fatigue attack.
Please let me know if there are any further organizational protocols I should follow or if the security team needs to perform a deeper forensic audit on the account logs.

DreamingSheep 5 Reputation points

2026-04-16T18:58:47.9366667+00:00

I've started getting these this week as well. My first thought was someone's brute forced my account, as it has it's own, unique password (seems tough though as the password is over 30 characters, multiple case/symbol/numerics).So I reset my password and less than 2 hours later, new sign in attempt.. There's no way that could be brute forced that quick, unless there's some sort of data leak.

So, I logged into my account again, start going through my security settings, nothing's been changed. Sign in activity is only showing 3 sign in's, which were all me.

As I was going through it all, I realised, the day before and 'today' when signing in, neither time was I asked for my password, just put my email address in and boom, MFA request.

So, I think the real problem is that MS have decided to skip asking for password (passwordless option was still disabled in my account) and go straight to an MFA request. So I assume that all the previous attempts people have made and got stopped at the password stage, are now coming across as to me with an MFA request.

I'm going to assume yours is the same..
Victor1-V 13,045 Reputation points Microsoft External Staff Moderator

2026-04-17T14:10:32.17+00:00

Hi DreamingSheep,

What you’re describing aligns with what the original poster is seeing. Unexpected MFA “Approve sign‑in” prompts can continue even after a password change and do not, by themselves, mean the account was accessed or that passwords are being skipped.

For that reason, I’d recommend following the same account‑securing steps already outlined above (recent activity review, sign out everywhere, alias sign‑in restrictions, app password checks, and treating unexpected MFA prompts as deny/secure).

If you’ve already tried those steps, it would be helpful to share which ones you completed and whether the prompts continued afterward.

As a reminder, this is a user‑to‑user forum, so contributors can’t see backend logs, but those steps are the correct way to fully lock down a personal Microsoft account in this scenario.
Hannish Parayil Gopalakrishnan 20 Reputation points

2026-04-23T02:13:02.2166667+00:00

@Victor1-V
Steps I have already taken :

Session Termination: Performed a global 'Sign out from everywhere.'

Credential Update: Successfully changed the account password.

MFA Configuration: Transitioned to 'Passwordless' login and re-synced my Microsoft Authenticator app (including a full uninstall and reinstall).

Security Audit: Reviewed and applied all standard security tips provided in the account dashboard.

Despite these actions, I am still receiving frequent, unauthorized push notifications
Victor1-V 13,045 Reputation points Microsoft External Staff Moderator

2026-04-23T14:00:15.2933333+00:00
Hannish Parayil Gopalakrishnan

Since you have already completed the main security steps and the issue is still persisting, the next step is to contact Microsoft Support so they can review what options are available for your account. You can try the following:

Visit the Microsoft Support contact page: Contact - Microsoft Support

In the search bar provided on the page, type "Account Security" and press Enter.

Click on the "Get Help" button that appears.

Scroll down the page until you see and click on the "Contact Support" option.

When prompted to select your product or service, choose "Other Products".

For the category, choose "Manage Account Security".

Look for and click on "Chat with a support agent in your web browser".

When prompted, provide a valid contact email where Microsoft can reach you regarding your case.

Explain your situation clearly: Be concise but provide all the relevant details.

Since this is a public forum, so we cannot access or escalate accounts directly. Also, support agents cannot bypass account security checks, but they can help confirm what options are available in your case.

I hope this helps.

Answer accepted by question author

EmilyS726 276.4K Independent Advisor

Hello

If you get attempts, as long as they are failed ones, it doesn't mean they managed to get into your account.

If someone knows your email address, they can go to Microsoft online and use the forgot password option to trigger an 2FA ask. This is common if your email address is involved in any data breach.

I would recommend that you do this to stop this:

Go to your Microsoft account online https://account.live.com> Sign in > Your info > Sign in preference. Add an alias - You have two options here: Create new: this will allow you to use the native domain outlook.com to create a new alias. Add existing: this will allow you to add a 3rd party email address, such as yahoo, gmail, as long as they are not already associated with another Microsoft account. Once added, make this new alias your primary alias, do NOT delete the old alias. Then at the bottom, click on "Change sign in preference". On the next page, uncheck the box for the old alias. This means, from now one, the old alias cannot be used to sign into your Microsoft account, but it can be still used to receive emails, etc.

0 comments

3 additional answers

Your answer

DreamingSheep 5 Reputation points

2026-04-16T18:58:47.9366667+00:00

I've started getting these this week as well. My first thought was someone's brute forced my account, as it has it's own, unique password (seems tough though as the password is over 30 characters, multiple case/symbol/numerics).So I reset my password and less than 2 hours later, new sign in attempt.. There's no way that could be brute forced that quick, unless there's some sort of data leak.

So, I logged into my account again, start going through my security settings, nothing's been changed. Sign in activity is only showing 3 sign in's, which were all me.

As I was going through it all, I realised, the day before and 'today' when signing in, neither time was I asked for my password, just put my email address in and boom, MFA request.

So, I think the real problem is that MS have decided to skip asking for password (passwordless option was still disabled in my account) and go straight to an MFA request. So I assume that all the previous attempts people have made and got stopped at the password stage, are now coming across as to me with an MFA request.

I'm going to assume yours is the same..
Victor1-V 13,045 Reputation points Microsoft External Staff Moderator

2026-04-17T14:10:32.17+00:00

Hi DreamingSheep,

What you’re describing aligns with what the original poster is seeing. Unexpected MFA “Approve sign‑in” prompts can continue even after a password change and do not, by themselves, mean the account was accessed or that passwords are being skipped.

For that reason, I’d recommend following the same account‑securing steps already outlined above (recent activity review, sign out everywhere, alias sign‑in restrictions, app password checks, and treating unexpected MFA prompts as deny/secure).

If you’ve already tried those steps, it would be helpful to share which ones you completed and whether the prompts continued afterward.

As a reminder, this is a user‑to‑user forum, so contributors can’t see backend logs, but those steps are the correct way to fully lock down a personal Microsoft account in this scenario.
Hannish Parayil Gopalakrishnan 20 Reputation points

2026-04-23T02:13:02.2166667+00:00

@Victor1-V
Steps I have already taken :

Session Termination: Performed a global 'Sign out from everywhere.'

Credential Update: Successfully changed the account password.

MFA Configuration: Transitioned to 'Passwordless' login and re-synced my Microsoft Authenticator app (including a full uninstall and reinstall).

Security Audit: Reviewed and applied all standard security tips provided in the account dashboard.

Despite these actions, I am still receiving frequent, unauthorized push notifications
Victor1-V 13,045 Reputation points Microsoft External Staff Moderator

2026-04-23T14:00:15.2933333+00:00

Hannish Parayil Gopalakrishnan

Since you have already completed the main security steps and the issue is still persisting, the next step is to contact Microsoft Support so they can review what options are available for your account. You can try the following:

Visit the Microsoft Support contact page: Contact - Microsoft Support

In the search bar provided on the page, type "Account Security" and press Enter.

Click on the "Get Help" button that appears.

Scroll down the page until you see and click on the "Contact Support" option.

When prompted to select your product or service, choose "Other Products".

For the category, choose "Manage Account Security".

Look for and click on "Chat with a support agent in your web browser".

When prompted, provide a valid contact email where Microsoft can reach you regarding your case.

Explain your situation clearly: Be concise but provide all the relevant details.

Since this is a public forum, so we cannot access or escalate accounts directly. Also, support agents cannot bypass account security checks, but they can help confirm what options are available in your case.

I hope this helps.

Answer 1

Hannish Parayil Gopalakrishnan 20

Thank you everyone for your support. It looks like the issue has resolved itself.

0 comments

Answer 2

Hi Hannish Parayil Gopalakrishnan,

I understand how worrying it is to secure your Hotmail account (password changed and MFA enabled) and still keep receiving unexpected “Approve sign-in request” prompts in Microsoft Authenticator.

I also noticed there is a Q&A Assist answer in the thread. Its core direction (reviewing sign-in activity and securing the account) is generally aligned with the official account-security flow. Have you had a chance to try the Q&A Assist steps yet? If you did and the prompts continue, I would like to add a few key actions.

1, Use the “Recent activity” page actions, not just a password change

On the Recent activity page, you can expand entries and use actions like “This wasn’t me” (when available) and “Secure your account” to trigger the built-in protection flow. This is separate from simply changing the password, and it’s the right place to validate whether any access looks unfamiliar. What happens if there's an unusual sign-in to your account - Microsoft Support

2, Sign out everywhere (force all sessions to re-authenticate)

Even after a password change, previously signed-in sessions may remain active until they are revoked. The account security dashboard includes “Sign out everywhere” under Advanced security options to sign out browsers and apps on trusted devices. How to sign out of your Microsoft account everywhere - Microsoft Support

3, If you have multiple aliases, restrict which one can be used to sign in

If the account has more than one alias, you can block sign-in for specific aliases using Sign-in preferences. This helps reduce unwanted sign-in attempts targeting an older email/alias while keeping the alias on the account. Block an email address from signing in - Microsoft Support

4, Check for app passwords (only if you have older apps/devices connected)

If two-step verification is enabled and older apps/devices are connected, the account may be using app passwords (created under Advanced security options). Reviewing that section can help you identify whether an older device/app is still attempting to authenticate.

5, Treat unexpected codes/prompts as “deny and secure,” not something you must approve

If you receive verification codes or prompts you did not initiate, do not use those codes and do not approve the request. The verification-code guidance explains that unrequested codes can happen when someone is trying to access the account or when information is entered incorrectly, and it points back to securing the account and strengthening sign-in methods.

Please note that this is a user-to-user forum, so there is no access here to investigate the account directly on the service side, but the steps above are the correct self-service security paths for this situation.

I hope this helps you fully lock down the account and reduce those unexpected prompts.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Victor1-V 13,045 Reputation points Microsoft External Staff Moderator

2026-04-14T13:09:54.16+00:00

I hope you are doing well Hannish Parayil Gopalakrishnan.

I'm following up to check if you've had a chance to look over my reply.

Please feel free let me know if you need any further assistance. I look forward to hearing back from you.

Answer 3

Follow these steps to contain the compromise and harden the account against ongoing attacks:

Review recent sign-in activity
- For a work or school account, go to the My Account portal → Recent Activity and review each sign-in, including location, app, browser, and operating system.
- If any successful sign-in is not recognized, immediately change the password again and then go to Security info to update security settings, such as MFA methods and sign-in options.
- Be aware that IP-based locations can look unfamiliar (for example, mobile traffic routed through another state), so verify device, browser, and app details as well.
Respond to suspicious successful and unsuccessful sign-ins
- If unfamiliar successful sign-ins are found, treat them as a likely compromise: change the password and update security info.
- If there are many unsuccessful sign-ins, this can indicate password-guessing or MFA fatigue attempts. Register and enforce strong multi-factor authentication (for example, Microsoft Authenticator with number matching) so that password-only attacks are not sufficient.
- If any sign-in shows “Additional verification failed, invalid code,” assume the password may already be known to the attacker and change it again, then review and update security info.
Secure the Microsoft account itself
- If this is a personal Microsoft (Hotmail/Outlook.com) account and there is suspicion that someone accessed it:
  - Check the Recent activity page for unusual sign-ins and mark any that were not performed by the legitimate owner.
  - Follow the guidance in How to recover a hacked or compromised Microsoft account, including:
    1. Run a full antivirus/malware scan on all devices used to access the account before changing passwords.
    2. Change the Microsoft account password using a strong, unique password.
    3. Review account settings such as connected accounts, forwarding, and automatic replies to remove any attacker-added configuration.
Enforce stronger MFA and reduce MFA fatigue risk
- Keep MFA enabled and ensure only trusted methods are configured in Security info.
- Remove any unrecognized phone numbers, email addresses, or app-based methods.
- Do not approve any unexpected MFA prompts. Treat repeated prompts as an attack signal and proceed with password change and security review.
Organizational protocols and escalation
- For work or school accounts, follow internal incident response procedures:
  - Report the incident to the organization’s security or IT team with timestamps, approximate locations, and screenshots of suspicious sign-ins or MFA prompts.
  - Request that the security team review sign-in logs and conditional access/MFA logs for the account to confirm whether there were successful attacker sign-ins and to identify the source IPs and applications involved.
  - Ask the security team to force sign-out of all active sessions and require re-registration of MFA if necessary.
Ongoing monitoring
- Continue to monitor Recent Activity / My sign-ins regularly for new suspicious attempts.
- If new suspicious successful sign-ins appear after remediation, repeat password change, review security info, and coordinate with the security team for deeper investigation.

References: