ACCOUNT COMPROMISED

Question

Hi,

My account has been compromised and I have changed the password, confirmed there are not forwarding email addresses but emails keep on coming in. What do I do?

Answer 1

If the password was already changed and no forwarding address is configured, check for other common compromise changes that can keep mail flowing or hide mail:

1. Scan the PC for malware before making more account changes.
   • Open Windows Security.
   • Go to Virus and threat protection.
   • Select Scan options > Full scan > Scan now.
2. Review recent sign-in activity and report anything unfamiliar.
   • Go to the Microsoft account Security basics page.
   • Select Review activity.
   • Mark unknown activity as This wasn't me or Secure your account.
3. Change the password again after the malware scan completes.
   • Use a strong new password.
   • If sign-in fails, use password reset or the sign-in helper.
4. Check account settings that attackers commonly change.
   • Review connected accounts.
   • Review forwarding.
   • Review automatic replies.
   • In Outlook on the web, also check for suspicious Rules that forward, redirect, delete, or move messages to folders such as Junk Email, Notes, or RSS Subscriptions.
5. Review mailbox symptoms that indicate the account is still affected.
   • Missing or deleted email.
   • Suspicious messages in Sent Items or Deleted Items.
   • Frequent password changes or unexplained lockouts.
   • Recently added external forwarding.
   • Suspicious signatures.
6. Remove other attacker access paths.
   • Delete existing app passwords and create new ones if app passwords are in use.
   • Check security info and remove any unknown recovery methods, devices, or sign-in methods.
7. Turn on two-step verification or MFA.
   • This is strongly recommended to prevent continued access after a compromise.
8. If access problems continue, use the account recovery and support paths.
   • Start with the sign-in helper tool.
   • If needed, use Contact Support.

---

References:

• How to recover a hacked or compromised Microsoft account
• What happens if there's an unusual sign-in to your account
• Respond to a compromised cloud email account
• My @msn.com Email Has Been Hijacked - Microsoft Q&A
• my email has been hacked and I cannot receive emails - Microsoft Q&A