Email compromised

Question

Someone is able to send emails from my Outlook account, and make it look like it came from me. Someone sent a letter to my customer, trying to change the wiring info for a construction deposit. How can I get them out of my account?

Answer 1

Hello

It is important to know if these emails were spoofed, or if they were really sent from your email account.

Can you first confirm - Do you find these emails in your sent folder?

Answer 2

Take immediate steps to secure the Outlook/Outlook.com account and remove the attacker’s access.

1. Regain and secure account access

• Change the account password to a strong, unique one that is not used anywhere else.
• If not already enabled, turn on two-factor authentication (2FA) / multi-factor authentication for the Microsoft account so a password alone is not enough to sign in.
• If sign-in is blocked or the password has been changed by the attacker, follow the hacked-account recovery guidance at My Outlook.com account has been hacked (linked from the phishing and protection articles in the references).

2. Sign out attackers and remove their access paths

• Use the Microsoft account security page to sign out of all active sessions so any attacker currently logged in is disconnected.
• Review and remove any unknown app permissions or connected apps that might allow continued access.

3. Clean up malicious mailbox configuration A compromised mailbox often shows specific symptoms and configuration changes:

• Check for suspicious inbox rules:
  • In Outlook on the web, open Settings → Mail → Rules and delete any rules that:
    • Automatically forward email to unknown addresses.
    • Move messages to Notes, Junk Email, or RSS Subscriptions unexpectedly.
• Check for external forwarding:
  • In Outlook on the web, review Mail → Forwarding and remove any forwarding addresses that were not set up intentionally.
• Review mailbox content and settings:
  • Look for suspicious messages in Sent Items and Deleted Items (for example, messages changing payment or banking details).
  • Check the email signature for any fraudulent content (such as fake banking details or payment instructions) and remove it.
  • Verify contact details in the account profile/global address list entry (name, phone, address) and correct any changes.

4. Protect contacts and ongoing business

• Inform affected customers and contacts using a trusted channel (phone or a separate verified email) that the account was compromised and that any recent messages changing payment or wiring instructions may be fraudulent.
• Instruct them to ignore or delete suspicious messages and to verify any financial changes directly.

5. Watch for signs of continuing compromise Common signs that the account is or was compromised include:

• Mailbox blocked from sending email.
• Missing or deleted email.
• Suspicious inbox rules or external forwarding.
• Frequent password changes or unexplained account lockouts. If any of these reappear after cleanup, repeat the security steps above and consider running security scans on all devices used to access the account.

6. Ongoing phishing awareness

• Be cautious of emails that:
  • Promise rewards or urgent actions (for example, tax refunds, invoices for things not purchased).
  • Ask to enter the email address and password to open a document or unlock an attachment.
• In Outlook and Outlook.com, watch for:
  • A ? in the sender image (unverified sender).
  • A via tag showing a different sending domain than the visible From address.
  • Yellow or red safety bars warning about blocked or unsafe content.

These steps remove the attacker’s access routes (password, sessions, rules, forwarding, app permissions) and help prevent further fraudulent emails from being sent as if they were from the account.

---

References:

• Respond to a compromised cloud email account
• Common symptoms of a compromised Microsoft 365 email account
• Phishing and suspicious behavior in Outlook
• How can I identify a suspicious message in my inbox?
• Help protect your Outlook.com email account