I can't receive email after my account was hacked

Question

My email was hacked (my fault). I did a full scan of my computer and only then was I allowed to change my password. I have changed my password 3 times in the last 2 days following MS directions. I now use a passcode (pin) I disabled forwarding and removed a device I didn't know from my account.

I still can't get new email although it appears I can send mail. How can I receive email? Is my account still hacked?

Answer 1

Hi, @Jan Wingenroth

When an account is compromised, it may be used to send spam.

Your next first step should be the formal account reinstatement form https://www.microsoft.com/digitalsafety/account-reinstatement

---

If you haven't tried anything yet, please try to:

• Change your password again and make sure two-step verification is enabled.

Just to be safe, I’d recommend to sign out everywhere. Visit: https://account.live.com/proofs/manage/additional Scroll down to Sign me out and select "Sign me out".

• After signing out everywhere, please monitor if the issue persists in the coming hours.
• Please be patient for now. It may take 24+ hours for sending to work again.

If the issue still persists after 24+ hours, please check for any update from Microsoft regarding whether you filled out the account reinstatement form earlier.

---

Click "Add comment" to let me know.

Thanks!

Answer 2

Since the password has already been changed, forwarding was disabled, and an unknown device was removed, the next checks are the ones most commonly left behind after an account compromise:

1. Check mailbox storage first. If Microsoft cloud storage or the mailbox is full, Outlook.com cannot send or receive email. Messages sent while storage is full can bounce back to the sender and are unrecoverable.
2. Check Outlook.com mail settings on a computer:
   • Open Outlook.com settings.
   • Go to Mail > Rules and remove any rule that deletes, moves, or redirects mail.
   • Check Forwarding and make sure nothing is still forwarding or redirecting messages.
   • If IMAP-related settings were changed during the compromise, remove anything suspicious there as well.
3. Check account security settings:
   • Review recent sign-in activity on the recent activity page to see whether there are still unfamiliar sign-ins.
   • Check aliases and sign-in preferences, and remove anything not recognized.
   • Remove existing app passwords if any are present.
   • Use Sign out everywhere so any remaining sessions are forced out. One accepted support answer notes this can take up to 24 hours to take effect.
4. Check account recovery-related settings that are commonly changed after a hack:
   • Connected accounts
   • Forwarding
   • Automatic replies
5. Check whether the account is temporarily blocked because of unusual sign-in activity. A blocked Outlook.com account can prevent normal mail flow. Use the Sign-in Helper to unblock it if needed.
6. If the account password was changed on the website and mail is also used in Outlook apps, update the saved password in Outlook so the app can sync again.

Based on the steps already completed, the account is not necessarily still hacked. A more common cause after recovery is that a malicious rule, forwarding setting, alias, app password, blocked state, or full storage is still affecting delivery.

If unfamiliar sign-ins still appear on the recent activity page after the password changes and sign-out, treat the account as still compromised and continue recovery through the Microsoft account recovery flow.

---

• Can't send or receive email in Outlook.com
• How to recover a hacked or compromised Microsoft account
• Unblock my Outlook.com account
• Email is missing from your Outlook.com inbox
• Help protect your Outlook.com email account
• After I got hacked, I changed password now I'm not receiving emails. - Microsoft Q&A
• my email has been hacked and I cannot receive emails - Microsoft Q&A