Possible Hack of email

Question

Several people have contacted me in regards to emails that they have received from my hotmail account asking them to buy things or send money.

Answer 1

Hi, @becky ray

This does sound like your account may have been compromised, especially if messages are being sent asking people for money or purchases.

First, if you can still sign in:

• Change your Microsoft account password immediately.
• Check your recent sign-in activity here: https://account.live.com/Activity

To be safe, I recommend the following steps:

Check your account rules and forwarding settings, hackers create rules that automatically forward or delete emails.

• You can do this in Outlook settings under Mail > Rules and Forwarding. https://support.microsoft.com/office/manage-email-messages-by-using-rules-in-outlook-c24f5dea-9465-4df4-ad17-a50704d66c59

Just to be safe, I’d recommend to sign out everywhere. Visit: https://account.live.com/proofs/manage/additional Scroll down to Sign me out and select "Sign me out".

• After signing out everywhere, please monitor if the issue persists in the coming hours.

---

To help narrow this down:

1. Can you still sign in to the Hotmail account normally?
2. Do you see any unfamiliar sign-ins under "Recent activity"?
3. Are these scam emails showing in your "Sent Items" folder, or are people only telling you they received them?

---

Click "Add comment" to let me know.

Thanks!

Answer 2

This can mean the account was compromised, or the sender address was spoofed. Take these steps immediately:

1. Run a full malware scan on the PC before changing the password. In Windows Security, open Virus and threat protection > Scan options > Full scan > Scan now.
2. Change the Microsoft account password. If sign-in fails, use the password reset flow instead.
3. Check recent sign-in activity on the recent activity page to confirm whether there were unfamiliar sign-ins or security challenges.
4. Review Outlook.com account settings that attackers commonly change:
   • Connected accounts
   • Forwarding
   • Automatic replies
5. In Outlook.com, be cautious with any message showing an unverified sender indicator such as a ? in the sender image or a via tag, because that can indicate spoofing.
6. If the suspicious messages only appear to come from the address, spoofing is possible. Do not reply, do not click links, and report phishing messages.
7. Add security info such as an alternate email address and mobile phone number to make account recovery easier.

If there are signs the account was hacked, use the Microsoft account recovery helper tool. It can provide self-help steps or offer the chance to talk to an agent.

---

References:

• How to recover a hacked or compromised Microsoft account
• Help protect your Outlook.com email account
• Phishing and suspicious behavior in Outlook