My account was hacked

Follow these steps in order, using the uncompromised account or a clean device where possible:

1. Clean the hacked device

• Before doing anything else, run a full antivirus/malware scan on the PC that was breached.
• On Windows 10/11, turn on and run Windows Defender:
  • Select Start and search for Windows Defender (or open it from Settings) and run a full scan.
• Make sure automatic updates and regular scans are enabled.

2. Try to recover or secure the hacked Microsoft/Outlook.com account

• Use the official hacked-account troubleshooter: How to recover a hacked or compromised Microsoft account.
• If you can still sign in:
  • Immediately change the password to a strong, unique one.
  • Then check and fix these settings (attackers often change them):
    • Connected accounts
    • Forwarding
    • Automatic replies
  • Remove any forwarding rules or auto-replies you don’t recognize.
• If you cannot sign in because the password, phone, or email were changed:
  • Use the recovery options in the article above and fill out the account recovery form with as much accurate info as possible.
  • If the security info was replaced and the web form keeps failing, there may be no further way to regain that specific account, even for Support.

3. Check for unusual sign-ins and report “this wasn’t me”

• Sign in to the Security basics page for the affected Microsoft account if possible.
• Select Review activity and look at the Recent activity page.
• For any sign-ins from other countries or devices that are not yours:
  • If they appear under Unusual activity, expand the item and select This wasn’t me.
  • If they appear under Recent activity, expand and select Secure your account.
• Then change the password again from the Security basics page.

4. If the account is blocked or locked

• If Outlook.com has temporarily blocked the account because of unusual activity, use the Sign-in Helper from the Unblock my Outlook.com account article to unblock it:
  • Unblock my Outlook.com account
• If you still can’t unblock it with a code or password change, follow the “When you can’t sign in to your Microsoft account” link in that article.

5. If the attacker changed all security info (phone/email) and recovery keeps failing

• When all old security info was removed and replaced, the account can enter a “security info change pending” state for 30 days.
• On that pending screen, use whichever option appears:
  • Cancel this request (only if you initiated the change and still have access to the old security info), or
  • Let us know (if you did not make the change; this starts the “unauthorized change” flow).
• If the recovery form and pending-flow options fail repeatedly and the security info is fully controlled by the attacker, there is no other supported way to recover or delete that account. Microsoft Support cannot override this.

6. If you regain access, remove attacker details and lock down the account

• Remove any unknown aliases or sign-in emails from Manage how you sign in.
• Remove any phone numbers or alternate emails you don’t recognize from Security info.
• Add safe security info (phone, alternate email, Microsoft Authenticator) as described in How to help keep your Microsoft account secure.
• Turn on sign-in alerts and review recent activity regularly.

7. Protect the other Outlook/Microsoft account and devices

• For the second (still-safe) account and any other accounts on that PC:
  • Change passwords from a clean device after malware scans.
  • Add extra verification methods (phone, alternate email, Authenticator) using the Advanced security options page.
  • Avoid staying signed in on shared/public computers; always sign out and close the browser.

8. If recovery fails and the attacker keeps using the account

• If the hacked account cannot be recovered, it also cannot be closed or deleted from the outside.
• Focus on:
  • Securing all other accounts (email, banking, social media) that ever used that Outlook address as a login or recovery email.
  • Updating those services with a new, secure email address.
  • Monitoring for suspicious activity elsewhere.

For direct assistance beyond the automated tools, use the Sign-in Helper and contact options referenced in the hacked-account and unblock-account articles, but be aware that if the recovery checks fail, Support cannot force account recovery or deletion.

References:

• How to recover a hacked or compromised Microsoft account
• What happens if there's an unusual sign-in to your account
• Hello , welcome to Account help & learning
• Unblock my Outlook.com account
• How to help keep your Microsoft account secure
• Help protect your Outlook.com email account
• My account got hacked. - Microsoft Q&A
• My account got hacked - Microsoft Q&A
• How do I send an email to Microsoft about my account being hacked and taken over by <removed> ? - Microsoft Q&A
• my microsoft account has been compromised - Microsoft Q&A
• Me robaron una cuenta - Microsoft Q&A
• Close your Outlook.com account