Forwarding Rule Stuck

Question

My personal Hotmail account appears compromised. Someone has created a forwarding rule that I cannot remove. It reappears every time I delete it. My recent sign-in history shows suspicious activity from the USA, Spain and Netherlands. I need help removing persistent malicious mailbox forwarding and securing my account

Answer 1

Hello,

I am going to share with you a comprehensive list of things to do. Please feel free to skip any steps you have already completed, except the first step, which is very important.

Please complete these steps on a computer, not on a smartphone or tablet.

Step 1: Sign out everywhere FIRST

Go to https://account.microsoft.com/security and sign in.

Go to Manage how I sign in, scroll down, and click Sign out everywhere.

This is intended to disconnect any active sessions that may still have access to your Microsoft account.

IMPORTANT: This process can take up to 24 hours to fully take effect. This means someone who is already signed into your account may not be disconnected immediately. Please do not expect immediate results within the 24 hours.

Continue the following after the 24-hour wait is over.

====================

Step 2: Review your Outlook settings

Go to https://www.outlook.com and sign in.

Click the gear icon in the top right corner to open Settings.

Under Mail, review the following areas:

Rules

If any rules are listed that you did not create, delete them. If you do not use rules at all, you can delete all of them.

Conditional formatting

If anything is set up there that you did not create, delete it.

Forwarding and IMAP

If you see any entries or settings you did not create, remove them. Turn off POP and IMAP if you do not use them.

Junk

Review your Safe senders and Blocked senders lists. Remove any unfamiliar entries from the Safe senders list.

After that, exit Settings and return to Outlook.com.

Open the To Do section by clicking the blue checkmark icon on the left side. Delete anything there that was not created by you.

====================

Step 3: Review your Microsoft account

Go to https://account.live.com.

Under Your info > Sign-in preferences, review all aliases on your account. If you see any alias you do not recognize, remove it. Be careful not to delete any legitimate email address you still use.

Next, go to the Devices section of your Microsoft account and remove any devices you do not recognize.

====================

Step 4: Secure your account

Go to the Security section of your Microsoft account.

Change your password to a new, strong password that you have never used before.

Enable two-step verification.

Go to Manage how I sign in and make sure all security contact information belongs to you.

On that same page, scroll down to App passwords and remove any existing app passwords you do not need.

====================

Step 5: Review app permissions

Go to https://account.microsoft.com/privacy/app-access.

Review the apps that have permission to access your Microsoft account.

Click Don't allow for anything you do not recognize or no longer use.

========

Step 6: Remove hidden rules.

If you use Classic Outlook on any Windows device, do this on those devices

Close Outlook completely.

Press Win + R on your keyboard to open the Run dialog.

Type outlook /cleanrules and press Enter to clear and reset client-side rule stores

Answer 2

Sign out the Microsoft account everywhere, allow up to 24 hours for existing sessions to be terminated, and only then remove the forwarding configuration again so an active unauthorized session cannot immediately recreate it.

1. Terminate existing sessions

1. Open the Microsoft account Security dashboard.
2. Select Advanced security options.
3. Scroll to Sign out everywhere, then select Sign out.
4. Allow up to 24 hours for browsers and apps to be signed out. This does not sign out an Xbox console. ^1^

Avoid using the mailbox for sensitive communication until the forwarding stops.

2. Secure the device and account

From a trusted computer:

1. Run an updated antivirus full scan. In Windows Security, select Virus & threat protection → Scan options → Full scan → Scan now.
2. After the scan completes, change the Microsoft account password to a strong password not used on any other site. If that old password was reused elsewhere, change it on those services too.
3. In Security → Advanced security options:
   • Enable two-step verification or Microsoft Authenticator.
   • Remove unfamiliar verification email addresses, phone numbers, or authentication methods.
   • Remove app passwords that are unknown or no longer required.
   • Generate a new recovery code and store it securely.

Microsoft’s compromised-account procedure specifically orders the malware scan before changing the password, preventing a compromised device from capturing the replacement password. ^2^

3. Review the suspicious activity

Open Security → Recent activity and expand the entries from the USA, Spain, and Netherlands.

• For an entry under Unusual activity, select This wasn’t me if it was not yours or if uncertain.
• For suspicious entries under Recent activity, select Secure your account.
• Review the access method, device/app, time, and IP address. Location alone can be imprecise because mobile providers may route traffic through other places, but an unfamiliar successful sign-in or automatic synchronization session should be treated as unauthorized. ^3^

Also inspect the activity list for unfamiliar aliases, security-information changes, app passwords, or application permissions.

4. Remove all forwarding paths after the sign-out period

Use Outlook.com in a desktop browser:

1. Go to Settings → Mail → Forwarding and IMAP.
2. Select Disable forwarding, remove the unknown address if displayed, and select Save. ^4^
3. Go to Settings → Mail → Rules.
4. Delete the malicious rule again. This retry differs from the previous deletions because it occurs after existing sessions have been invalidated.
5. In Forwarding and IMAP, disable POP or IMAP if they are enabled and you do not use them.
6. Review Automatic replies, Junk email, blocked/safe senders, and connected mail clients for changes you did not make.

Temporarily remove this Hotmail account from third-party clients and devices—such as Apple Mail, Thunderbird, classic Outlook, or mobile mail apps—until the rule no longer returns. Reconnect only recognized clients using the new credentials.

If forwarding returns after 24 hours

Use Microsoft’s hacked-account recovery tool; it can provide account-specific recovery steps and may offer contact with an agent. ^2^

For Outlook.com support, select Help in Outlook.com, describe the persistent malicious forwarding, then scroll to Still need help? → Yes. Microsoft support cannot manually disclose or change protected account details, but it can route the case through the available account-recovery options. ^5^

There is no Microsoft 365 administrator or Exchange mail-flow rule available for a personal Hotmail account; those controls apply to organizational Microsoft 365 tenants, not Outlook.com consumer mailboxes.

---

References

1. How to sign out of your Microsoft account everywhere | Microsoft Support
2. How to recover a hacked or compromised Microsoft account | Microsoft Support
3. What is the Recent activity page?
4. [Outlook.com](https://support.microsoft.com/outlook/mail/turn-automatic-forwarding-on-or-off-in-outlook)
5. How to help keep your Microsoft account secure | Microsoft Support