Reclaiming a hacked account

Question

a week ago my friends alerted me that they started to receive strange e-mails from my outlook.com e-mail address asking to talk.

I have reset the password on my Microsoft account and pressed the option to sign out all devices, but since then I have not received any e-mails into my inbox. I thought it might be a phone issue but having logged into the website they are not there either.

E-mails that get picked up by the spam filter and sent to the junk folder are being received.

Answer 1

Hi, @BrendaB

When an account gets compromised, hackers sometimes change mail rules, forwarding settings, or even block incoming emails.

Your next first step should be the formal account reinstatement form https://www.microsoft.com/digitalsafety/account-reinstatement

---

In the meantime, while Microsoft is reviewing your account reinstatement request:

• Make sure two-step verification is enabled.
• Check your account rules and forwarding settings, hackers create rules that automatically forward or delete emails. You can do this in Outlook settings under Mail > Rules and Forwarding. https://support.microsoft.com/office/manage-email-messages-by-using-rules-in-outlook-c24f5dea-9465-4df4-ad17-a50704d66c59

Just to be safe, I’d recommend to sign out everywhere. Visit: https://account.live.com/proofs/manage/additional Scroll down to Sign me out and select "Sign me out".

• After signing out everywhere, please monitor if the issue persists in the coming hours.

---

If the issue still persists after 24+ hours, please check for any update from Microsoft regarding whether you filled out the account reinstatement form earlier.

---

Click "Add comment" to let me know.

Thanks!

Answer 2

This pattern usually means the account was compromised and mail is being redirected, deleted, or filtered by mailbox settings that were changed during the attack.

Since the password was already reset and all devices were signed out, take these steps next:

1. Check recent sign-in activity
   Go to the Microsoft account Security basics page and select Review activity. If any sign-ins are unfamiliar, mark them as This wasn't me or Secure your account.
2. Check Outlook.com forwarding
   In Outlook.com, open Settings > Mail > Forwarding. Turn off forwarding if it is enabled, and remove any address that was not added intentionally.
3. Check Outlook.com rules
   In Outlook.com, open Settings > Mail > Rules. Delete any rule that was not created intentionally, especially rules that move, delete, or redirect incoming mail.
4. Check automatic replies and connected accounts
   Review automatic replies and connected accounts and remove anything unfamiliar.
5. Review other folders carefully
   Check Deleted Items, Junk Email, Archive, and any custom folders. Attackers often create rules that move messages out of the Inbox instead of blocking delivery entirely.
6. Scan devices for malware before changing the password again
   Run a full antivirus scan first. In Windows Security: Virus and threat protection > Scan options > Full scan > Scan now. This matters because changing the password before cleaning the device can allow the new password to be stolen again.
7. Change the password again after the scan
   After the device scan completes, change the Microsoft account password again and use a strong password.
8. Add or verify security info
   Make sure the account has valid recovery information such as an alternate email address and mobile phone number so account recovery is easier if access is lost again.

If the account is blocked or cannot be unblocked normally, use the Sign-in Helper. If sign-in or recovery still fails, use When you can't sign in to your Microsoft account.

---

References:

• How to recover a hacked or compromised Microsoft account
• What happens if there's an unusual sign-in to your account
• Help protect your Outlook.com email account
• Unblock my Outlook.com account