Log into Email

Question

I was hacked a couple of weeks ago and changed my password. I try to login to my email and it says I have tried unsuccessfully too many times! This never happened before the hack and I only login no more than 4 - 6 times a day and use my correct password. Are hackers trying to get back into my email account??

Answer 1

Hi William Makris,

I’m really sorry you’re going through this. Being hacked is stressful enough, and then getting locked out afterward, especially when you know you’re using the right password.

To answer your question: Yes. Repeated lockouts are sometimes caused by ongoing automated sign‑in traffic. But that doesn’t always mean attackers are getting back in. The period often continues because the timer keeps resetting. Here’s what you should do:

• Stop all sign‑in attempts completely for a full cooldown period
• That includes not checking email, not retrying “just once.”
• Make sure no other devices or apps are trying in the background
• Do not change your password again during this wait period.

This type of lockout is Microsoft temporarily protecting the account. Once the system sees a clean window with no attempts, access usually restores on its own. After you’re back in, follow the suggestions already shared in Q&A to secure your account. Let me know if the prompt keeps coming back even after that.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Yes, repeated lockouts can be caused by attackers trying to sign in, even if the correct password is used only a few times a day. The account may be seeing many failed attempts from other locations or devices, which triggers protection and results in the “too many attempts” message.

Take these steps to secure and check the account:

1. Review recent sign-in activity
   • Go to the Recent activity page.
   • Review all sign-ins from the last 30 days. Look for unfamiliar locations, devices, or apps.
   • If any activity is not recognized, follow the prompts there to secure the account.
   • For more details on what this page shows, see What is the Recent activity page?.
2. Change the password again
   • From the Security settings page, change the password to a new, strong one that has not been used before.
   • This helps if an attacker already knows the current password.
3. Update security info and sign out everywhere
   • On the same Security settings page, update security info (phone, alternate email) and remove anything not recognized.
   • Remove all trusted devices and use the option to sign out of all sessions so any attacker is forced to sign in again with the new password.
4. Check for unusual sign-in patterns
   • If successful sign-ins appear from unfamiliar locations or devices, treat that as possible compromise and immediately change the password and update security info.
   • If there are many unsuccessful sign-ins, that can indicate someone is trying to guess the password. Enabling two-step verification (multi-factor authentication) is strongly recommended so a password alone is not enough.
5. Scan devices for malware
   • Before or after changing the password, run a full antivirus scan on the PC and any device used to access the account, using Windows Defender or another up-to-date antivirus, to ensure there is no malware capturing credentials.

If sign-in remains blocked after some time, use the account recovery flow starting from Recover your account and follow the steps to verify identity and reset the password.

---

References:

• Check the recent sign-in activity for your Microsoft account
• View your work or school account sign-in activity from My Sign-ins
• How to recover a hacked or compromised Microsoft account
• My username and password have stopped working
• What happens if there's an unusual sign-in to your account