unrequested password reset code

Question

Hi,

Early today I looked at an email message in my hotmail inbox on my iPhone. The contents were somewhat suspicious (it claimed to contain a receipt for an unspecified item). There was a link in the email. I did not click on the link and later deleted the email. However, when I tried to return from this email to my inbox, the phone instead strangely returned to the home screen of my iPhone. Immediately afterwards I got a message on my iPhone saying 'cannot download "numbers" app'. This made me suspicious that the email I had opened was trying to hack my phone.

A couple of hours after this I got a password reset code from the Micrososoft account team in my google email account (I'm not sure whether the two accounts are linked), even though I did not try to reset my password at that time. The MS account email address that sent this code appeared genuine, as it exactly matched the address that sent a confirmation email when I later did reset my password (******@accountprotection.microsoft.com). 

I have been able to get into my Hotmail account on my PC without any issues, and reset the password, but I am worried that the unasked for attempt to reset my hotmail account is linked to the earlier attempt to download the 'numbers' app on my iPhone, and that my phone has been hacked in some way.

Is it possible to get some information on where and how the password reset request was made?

Is it possible my iPhone has been hacked? If so, should I avoid accessing my outlook account on my iPhone (as I will need to enter the new password, as I have reset it on my PC)?

Thanks,

Jamie

Answer 1

Hi Lucretius68,

Thank you for reaching out.

I’m Mel, an Outlook.com user, and Independent Advisor. Just to set your expectation, I don't work for Microsoft, but I'd be glad to help.

Simply opening the suspicious email from your phone but you did not reply, click a link, confirm anything, and just deleted the email, you should be safe.

If someone keeps trying to request a password reset for your account, they may have viewed your Microsoft email address somewhere else. Note that your email address can be fetched by malware, phishing emails, attacking Internet sites, or if you reply to unknown email senders. Make sure not to post your email address publicly, or subscribe to suspicious web pages.

Run anti-virus/anti-malware scans on your computer and security scans on your phone. Clear web browser's cache and make sure your phone software is updated.

Those requests can be annoying, but it's not something that will compromise your account by simply sending a password reset code to your email address.

No worries, as long as the person who's trying to reset your password doesn't have access to the requested security code or to your account password, they can't change your password or access your account.

You also have an option to change the alternate email address associated with your account so they can't use your alternate email account to send a password reset request and also for you to stop receiving their request.

Check the "Recent Activity" page of your account to view any unauthorized activity to your account on the last 30 days. Check the link below as your reference:

https://support.microsoft.com/en-us/help/13782/...

Also, I strongly recommended to turn on the two-step authentication in your account and then change to a strong password again. For information about the two-step authentication, you may refer to this link:

https://support.microsoft.com/en-us/help/12408/...

Refer to the link below and perform the tips on how to help keep your Microsoft account safe and secure:

https://support.microsoft.com/en-us/help/12410/...

Let me know if you have further concerns.

Stay safe and healthy. Have a great day!

Kind regards,

Mel