My hotmail account is hacked and fraudster charged on my credit card through ubereats/ubercash

Question

My hotmail account is hacked and fraudster charged on my credit card through ubereats/ubercash. How to fix this problem? When I log in to outlook (hotmail), all my emails are gone and I see these financial threats emails in foreign languages only

Answer 1

First, you need to get the language changed. To do so, go to www.outlook.com, click on the setting icons on the upper right, and use this photo to guide you to the location to change it back.

---

Next,

I am going to share with you the comprehensive list of things to do, please feel free to skip those you already did. This process can take up to 24 hours to see results, so do NOT expect immediate results.

Please complete these steps on a computer, not on a smartphone or tablet.

====================

First, go to https://www.outlook.com and sign in.

Click the gear icon in the top right corner to open Settings.

Under Mail, review the following areas:

Rules

If any rules are listed, delete all of them.

Conditional formatting

If anything is set up there, delete it.

Forwarding and IMAP

If you see any entries or settings you did not create, remove them. Turn off POP and IMAP.

Junk

Review Safe sender and blocked list. If you don't recognize any, remove them.

After that, exit Settings and return to outlook.com.

Open the To Do section by clicking the blue checkmark icon on the left side. Delete anything there that was not created by you.

====================

Go to https://account.live.com.

Under Your info > Sign-in preferences, review all aliases on the account. If you see any alias you do not recognize, remove it.

Next, go to the Devices section of your Microsoft account and remove any devices you do not recognize.

====================

Please also do the following in Security section

Change your password

Enable two-step verification

====================

Go here https://account.microsoft.com/privacy/app-access Click on "Don't allow" for anything you don't recognize.

=======================

Then go to Security > Manage how I sign in and make sure all contact information belongs to you.

On that same page, scroll down to App passwords and remove any existing app passwords.

Also on the same page, click on Sign out everywhere. This is intended to disconnect any active sessions that may still be connected. Please note that this can take up to 24 hours to fully take effect.

====================

In addition, this problem can sometimes be caused by a malicious script or infection on one of your devices.

Are you using a Windows computer to check email? Do you use an email app such as Outlook Classic or New Outlook?

If so, please open the app and remove the account from the app settings.

Then go to the Microsoft Safety Scanner download page:

https://learn.microsoft.com/defender-endpoint/safety-scanner-download

Download the 64-bit version, run a full scan, and let me know what the final results say.

---

As for the charges, since they happened on the Uber platform, it is best that you dispute it with your credit card company and work with Uber support to address that.

Answer 2

Take these actions immediately to secure the Outlook.com/Hotmail account and limit further damage:

1. Secure the computer and devices

• Run a full antivirus/malware scan on the PC or phone used to access Outlook.com before changing any passwords.
• If using Windows 10/11 or 8.1, turn on and run Windows Defender, then perform a full scan and enable automatic updates and regular scans.

2. Recover and secure the Microsoft/Hotmail account

• Follow the hacked-account recovery steps at How to recover a hacked or compromised Microsoft account. In summary:
  • After confirming the device is clean, sign in and change the account password to a strong, unique one. If sign-in is not possible, use the reset your password option.
  • Make sure the new password is not reused from any other site.

3. Check and clean up Outlook.com account settings Once access is restored, review all security-related settings because attackers often change them:

• Check connected accounts, forwarding, and automatic replies and remove anything unfamiliar.
• In Outlook.com, review Rules and delete any suspicious rules that move, delete, or auto-forward mail.
• Check Forwarding again in Outlook.com and remove any unknown forwarding addresses.

4. Review recent activity and sign out attackers

• Go to the recent activity page at https://account.live.com/activity to see when and where the account was accessed.
• If there is unfamiliar activity, use the options there to secure the account and sign out of suspicious sessions.
• Add or confirm alternate email and mobile phone as security info so recovery is easier if this happens again.

5. Treat the messages as phishing and malicious

• The “financial threats” emails in foreign languages are likely phishing or malicious:
  • Do not click links or open attachments in those messages.
  • If Outlook.com shows a yellow safety bar, only download attachments or click links if the sender is trusted.
  • If a red safety bar appears, delete the message; Outlook.com has blocked unsafe content.
• Use Outlook’s phishing handling guidance: messages that ask for passwords, payment info, or promise rewards should be treated as phishing.

6. Work with the bank and merchants on the fraudulent charges

• Contact the credit card issuer immediately (using the phone number on the card or statement) to:
  • Report the Uber/UberEats charges as fraudulent.
  • Request card replacement and dispute the unauthorized transactions.
• Continue to monitor card and bank statements for additional unauthorized charges.

7. Strengthen ongoing protection

• Ensure the operating system on all devices has the latest security updates and that automatic updates are enabled.
• Keep antivirus software installed and updated.
• Add as much security info (alternate email and phone) as possible to the Microsoft account.
• Be cautious with future emails:
  • Look for trusted sender indicators in Outlook.com.
  • Treat unexpected invoices, password-reset messages, or “reward” offers as suspicious.

If the account cannot be recovered using the official Microsoft account recovery and hacked-account steps, there is no alternate supported method; in that case, continue working with the bank to protect finances and consider creating a new, secure email account for future use.

---

References:

• How to recover a hacked or compromised Microsoft account
• Help protect your Outlook.com email account
• Phishing and suspicious behavior in Outlook
• My account got hacked - Microsoft Q&A
• Hacker set up continuous draft ransomware email - Microsoft Q&A