How to I regain control of a hacked email address

Question

Hi

My email has been hacked, I have changed my password and frozen my bank accounts. How do I now regain control of my account?

Answer 1

To regain control of your hacked email account, follow these steps:

1. Disable the Compromised Account: If you have access to the account settings, disable the account to prevent further unauthorized access.
   • If you are using Microsoft 365, you can disable the account using PowerShell commands. You will need to install the Microsoft Graph PowerShell module and run the necessary commands to disable the user account.
2. Reset Your Password: If you haven't already, change your password to a strong one that includes upper and lowercase letters, numbers, and special characters. Avoid using any of your last five passwords. Make sure not to send the new password via email.
3. Revoke User Access: Immediately invalidate any active sessions using the stolen credentials. You can do this by connecting to Microsoft Graph and revoking the user's sign-in session.
4. Enable Multifactor Authentication (MFA): If you regain access, enable MFA for added security. This will help protect your account from future compromises.
5. Check for Suspicious Activity: Look for any unauthorized changes in your account settings, such as email forwarding rules, changes to your contact information, or suspicious emails in your Sent Items or Deleted Items folders.
6. Monitor Your Account: Keep an eye on your account for any further suspicious activity and consider notifying your contacts that your email was compromised.
7. Contact Support: If you are unable to regain access or if the situation escalates, contact Microsoft support for further assistance.

Following these steps will help you regain control of your email account and secure it against future attacks.

Answer 2

The password change is a great first step; now activate 2-step verification. After this, close all your open sessions:

https://account.live.com/proofs/manage/additional

After this, please review the next link to see if any apps that you don’t know have access to your account and delete them:

https://microsoft.com/consent

Finally, do this in Outlook from Edge:

Sign in to Outlook.com

Click on the gear icon (Settings) in the upper right corner.

Look for and open Mail settings.

Go to the Rules section and check if there are any rules you didn’t create. If there are any suspicious rules (for example: “forward everything to @.___” or “move everything to Deleted”), delete them immediately.

Also check in Forwarding and IMAP and make sure there are no addresses added. If there is one and it’s not yours, remove the forwarding.