Outlook or Hotmail account hacked, what to do

Someone else can read your Outlook or Hotmail mail, send from it, or has changed the password so you cannot. Hotmail, Live, MSN, and Outlook.com are one Microsoft account. The inbox name can also be a country address, such as outlook.co.uk. Microsoft’s hacked-account page applies to that Microsoft account and to Outlook.com.

A mailbox at your company, such as a Microsoft 365 address your workplace gave you, is a different door. Skip to the work section below. The consumer recovery form will not reset it.

If you can still sign in, scan the computer, change the password, then check the settings that keep reading mail after a password change. If you cannot sign in, use Microsoft’s sign-in helper before you fill in a form. The longer personal checklist, including Gmail and iCloud Mail, is Personal email account hacked.

If you can still sign in

Microsoft wants a malware scan before the new password, on the Windows PC you use for this account. Their reason is that many people lose the password to malware that is already on that PC. Changing the password on an infected machine hands the new one over too.

On Windows:

1. Open Windows Security.
2. Open the Virus and threat protection tab.
3. Select Scan options, then Full scan, then Scan now.

Microsoft’s hacked-account article says to do this with whatever antivirus you already run, as long as it is up to date, and to let it scan on a schedule afterwards. Those click names are Windows Security. On a Mac or a phone, change the password from a device you trust, and still scan the Windows PC before you type the new password into it.

Then change the password.

1. Sign in at account.microsoft.com/security.
2. Use the password security options there, or follow Change your password in Outlook.com. The Outlook.com password is the Microsoft account password.
3. Microsoft may send a security code to your email or phone and ask you to confirm the address or the last four digits of the number.

Pick a password you have never used on this account or on any site that emails this address.

Microsoft says that because someone else had access, they have already reset some of your settings. They still tell you to check connected accounts, forwarding, and automatic replies. Do all three. A setting they did not reset is enough to keep the other person in the mail.

Forwarding

In Outlook.com:

1. Select Settings.
2. Select Mail, then Forwarding.
3. If Enable forwarding is on and the address is not yours, clear Enable forwarding and select Save.

Microsoft’s forwarding article says two-step verification has to be on before forwarding can be turned on. If it was off, turning forwarding on would have prompted to enable it. An attacker who enabled forwarding may have turned two-step verification on with their own phone. Check that next.

A rule can redirect mail even when the forwarding switch is off. Redirect keeps the original sender on the From line, so a reply goes to them, not to you. Forward shows the message as coming through your account.

Inbox rules

In Outlook.com:

1. Select Settings.
2. Select Mail, then Rules.
3. On any rule you did not create, select More actions, then Delete rule.

Microsoft’s rules article says a new Outlook.com rule applies to mail that arrives after the rule exists. You cannot run it backwards over mail already in the box. Read Sent, Junk, and Deleted for the period you did not control the account. A rule that deletes or files security alerts is how people miss the takeover.

Automatic replies

An out-of-office note you did not write can send your contacts to a fake address.

In Outlook.com or Outlook on the web, select Settings, then Account, then Automatic replies. Microsoft’s automatic-replies article uses that path. Turn the toggle off if the message is not yours, and select Save.

Recent activity and security info

Open Microsoft’s Recent activity page and use the link there to see your own list. It covers significant events from the last 30 days. Repeated sign-ins from the same device and place may show only the first one. A mobile network can place the dot in a city you were not in, because the carrier routes the connection elsewhere.

If a row sits under Unusual activity, expand it and choose This wasn’t me when it was not you. Microsoft then asks you to change the password and update security info. Choose This was me only when you recognise it. A new phone, a trip, or an app you allowed can look unusual and still be you.

In the ordinary list, these rows matter if you did not do them. Password changed. Alias added, alias deleted, or primary alias changed. Alternate email added or deleted. Phone number added or deleted. Identity verification app added or deleted. App password created. Permission given to an application. Two-step verification turned off. Two-step verification turned on, if you did not turn it on.

If an email tells you about unusual activity, sign in at account.microsoft.com/security by typing the address yourself. Microsoft says you can do that without clicking the link in the mail.

Then open Manage how I sign in on that Security tab. Remove a phone, an email, or an authenticator you do not recognise. Microsoft’s two-step verification article puts Turn on and Turn off under Additional security, then Two-step verification.

Turn two-step verification on once the contact methods are yours again. Microsoft is phasing out SMS as a way to sign in and to recover a personal Microsoft account, so add an authenticator app and a backup email, not only a phone number. They recommend three pieces of security info. If you lose the only contact method, the password alone will not get you back in. Microsoft says recovery can take 30 days, and you can lose the account.

App passwords are separate passwords for old apps and devices that cannot use a security code. They only exist when two-step verification is on. Microsoft’s app-password article puts them on the Advanced security options page, in the App passwords section. Compare that list with Recent activity. An App password created row you do not remember is a sign-in that bypasses the code.

If you cannot sign in

Use the sign-in helper first. It asks for the email or the phone number on the account. If it finds a problem, it tells you the next step. If it does not, it shows self-help. The hacked-account page says the same tool can also offer a chance to talk to an agent.

That agent still cannot reset the password for you. Microsoft’s recovery-form article says support agents are not allowed to send password reset links, or to open the account and change details. The same sentence is on the recent-activity page.

The recovery form is at account.live.com/acsr. The form says that if you have turned on two-step verification, you cannot recover the account this way. Microsoft’s help article says the same thing in longer form. If two-step verification is on and you cannot use any alternate method, they cannot help. Protecting the mailbox means they will not override it.

If two-step verification is off, and you do not recognise the email or phone they offer for a code, the sign-in helper is still the first stop. Then the form.

To fill it in:

1. Have a working email that is not the one you are recovering. A friend’s inbox is allowed. If you have no other inbox, Microsoft says you can create a temporary Outlook.com account from Create one on the sign-in page. They use this address only to write to you about the form.
2. Collect old passwords, the name and address you used when you signed up, and, for Outlook.com or Hotmail, names of people you wrote to and exact subject lines. Microsoft says a wrong guess does not count against you, and to fill every “add more” box you can. Years later, the file may still show a previous name or a previous city.
3. Use a device and a place Microsoft has seen before, such as your home computer, if you still can.
4. Watch the spelling. A message that the Microsoft account does not exist is often a typo, or a country domain.

Microsoft reviews the form and emails the result within 24 hours. If they verify you, that same working email gets the sign-in instructions. If they do not, you can submit again, up to two times a day.

Once you are in, do the forwarding, rules, activity, and security-info checks above. A recovered account that still forwards mail is still theirs.

If this is a work or school mailbox

Your administrator resets a Microsoft 365 work or school account. The consumer form at account.live.com/acsr is for a personal Microsoft account.

If you are the administrator, Microsoft’s password-reset article gives this path. You need a role that can reset passwords.

1. In the Microsoft 365 admin center, open Users, then Active users.
2. Select the person, then Reset password.
3. Create the password or let the center generate one, then select Reset password.
4. Print the details to a PDF and store that file somewhere safe. Share it with the person by a channel other than the mailbox you are fixing. Microsoft’s password-reset article says that as of 30 August 2024 the admin center removes the option to email those passwords.

Microsoft’s compromised-account guide gives a second reason to stay off email. The attacker may still be reading that mailbox.

Then sign the sessions out. Microsoft’s block-sign-in article says to select the user again, open the Account tab, and select Sign out of all sessions. An access token can keep working for up to an hour. Blocking sign-in can take up to 24 hours, so the password reset is what stops a fresh sign-in sooner.

A password reset does not delete app passwords. Microsoft says the person should delete the old app passwords and create new ones. In Outlook on the web, which is what a work or school account uses, inbox rules are under Settings, then Mail, then Rules. Delete any rule you did not create. The same menu is in Microsoft’s rules article.

If the mailbox sent a new bank account, a new invoice, or a password reset to a customer, call that person on a number you already had. The next page for a work mailbox is Business email compromised. How a bank handles the transfer depends on the country and on the account. We do not have one deadline that fits every bank.

For a personal Outlook.com or Hotmail account, the next page is Personal email account hacked. Change the password on the bank, the password manager, and any shop that emails this address, after the mailbox itself is clean.

Related playbooks

• Personal email account hacked. Someone else is in your email, which means they can reset the password on almost everything else you own.
• Business email compromised. An attacker may read mail, reset other accounts, impersonate the business, or redirect payments.