Microsoft/Outlook Account Hacked? How to Recover and Secure It

Your Microsoft account is rarely just an inbox. It is the login behind Outlook or Hotmail mail, OneDrive files, Teams, Xbox, the Microsoft Store, and — for a huge number of people — the sign-in for Windows itself. If it also runs a Microsoft 365 business tenant, it is the login your clients and suppliers trust when an email lands in their inbox from your name. A hacked Microsoft or Outlook account is rarely a minor inconvenience: it is often the first step in something much bigger, from identity theft to business email compromise (BEC) fraud. The good news is that Microsoft has a structured, effective recovery path, and if you work through it in the right order, most people get back in and close the door behind the attacker for good. Here is exactly how.

Signs Your Microsoft or Outlook Account Was Hacked

• You are signed out and your usual password no longer works.
• Microsoft sent an "unusual activity" or "your security info was changed" alert you did not trigger.
• Sent messages, or password-reset emails for other services, that you did not initiate — check your Sent Items folder.
• Your recovery email or phone number was changed without your consent.
• Sign-ins to OneDrive, Teams, or Xbox from a device or country you do not recognize.
• Contacts, clients, or suppliers report receiving spam, scam links, or suspicious payment requests from your address.

Step 1 — Start the Official Microsoft Recovery Process

Step 2 — Clean Out What the Attacker Left Behind

This is the step almost everyone skips, and it's the one that matters most for email. Changing your password alone does not remove an attacker's access — sophisticated intruders plant ways to keep reading your mail even after you lock them out of the login screen. Once you're back in, work through every item below:

• Inbox rules: Outlook.com Settings → Mail → Rules. Delete any rule you did not create that auto-forwards, copies, marks-as-read, or deletes incoming mail. This is the single most common technique attackers use for business email compromise — a silent rule that copies anything mentioning "invoice" or "payment" to an external address.
• Forwarding: Settings → Mail → Forwarding. Remove any forwarding address you did not add.
• Recovery email & phone: Security → restore your own and remove anything the attacker added.
• Connected apps and permissions: account.microsoft.com → Privacy → App permissions. Revoke anything you don't recognize.
• Sent Items folder: check exactly what the attacker sent while they had access — this tells you who needs a warning.
• Sign out everywhere: account.microsoft.com → Security → Sign-in activity → Sign out everywhere.

Step 3 — Lock It Down for Good

Why a Microsoft/Outlook Account Is Such a Valuable Target

Understanding the motive explains the urgency. With your Microsoft account, an attacker can:

• Reset passwords everywhere — banking, PayPal, shopping, and social media accounts all send reset links to your inbox.
• Search years of mail and OneDrive files for tax documents, invoices, scanned IDs, and passwords sent in plain text.
• Launch business email compromise (BEC) fraud — impersonate you to clients or suppliers to redirect a real payment to a fraudulent bank account.
• Hijack linked services — OneDrive, Teams, Xbox, Skype, and any app using "Sign in with Microsoft."
• Lock you out entirely by changing recovery details, then hold the account or your data for ransom.

Personal Account vs. Microsoft 365 Business Account: Two Different Paths

This is the single most important distinction in Microsoft account recovery, and the one most people get wrong first. A personal account (@outlook.com, @hotmail.com, @live.com, or even a Gmail address linked to a Microsoft account) is recovered by you, directly, through account.live.com/acsr exactly as described above.

A work or school account (typically an address at your company's own domain, managed through Microsoft 365) works completely differently: it belongs to your organization's infrastructure, controlled through the Microsoft 365 admin center or Entra ID (formerly Azure Active Directory). You generally cannot recover it yourself. Contact your internal IT team or managed IT services provider immediately. An administrator can reset the password in minutes, force sign-out on every active session, and — critically — check whether the attacker created mail flow rules or attempted business email compromise fraud against a client or supplier. For a small business, this scenario is often the costliest version of the problem, because a single compromised mailbox can be used to intercept a real invoice and redirect a real payment.

Recovery Paths Compared

Not every hacked account looks the same. Which recovery path applies to you depends on exactly what access, if any, you still have. Here's how the main options line up:

Don't Forget the Linked Services

Because one Microsoft login opens the entire ecosystem, recovering the account doesn't end the moment Outlook is back under your control. Several services share the exact same credentials and deserve a separate look once you're back in.

• OneDrive: check version history and the recycle bin for files that were deleted, moved, or shared publicly without your knowledge. An attacker with even a few hours of access can copy sensitive documents before you ever notice the intrusion.
• Microsoft Teams: for a work account, review channels and direct messages for anything sent in your name — especially unusual requests directed at colleagues in accounting or HR, a common precursor to internal-fraud attempts.
• Xbox and Microsoft Store: an attacker on a personal account can make unauthorized purchases against a saved card. Check the billing history at account.microsoft.com/billing.
• "Sign in with Microsoft": many third-party apps — games, productivity tools, forums — use this login. Review the full list under Privacy → App permissions and remove anything you no longer use or don't recognize.
• Windows itself: if your computer signs in with the same Microsoft account, a compromised password potentially exposes the full Windows session, including passwords saved in Edge. Changing the password typically forces a fresh sign-in on every linked Windows device — treat that as expected, not as a new problem.

Mistakes to Avoid After Recovering the Account

Stopping at the password change

This is the most common and most costly mistake. A new password without a review of inbox rules, connected apps, and active sessions often leaves the attacker with residual access — invisible until they use it again, sometimes weeks later.

Ignoring the Sent Items folder

Most people check their inbox but skip what the attacker actually sent while they had control. That folder is the fastest way to know whether contacts, clients, or suppliers received a fraudulent message that needs an immediate follow-up warning.

Reconnecting an infected device without cleaning it first

If the password was captured by malware on your computer rather than stolen through phishing, changing the password and signing back in from the same infected device exposes the new password to the same malware immediately. A full antivirus scan — or a clean reinstall — should come before reconnecting if infection is even a possibility.

Skipping a check of related accounts for a business

For an organization, one compromised mailbox is rarely the endpoint — it's often a stepping stone to other accounts through the internal address book or shared files. Limiting your review to only the account that was hit, without checking accounts that recently exchanged mail or files with it, leaves a window open for a second wave.

When to Call IT Cares

• The hacked account is a Microsoft 365 business account and your internal IT support isn't available quickly.
• You cannot complete recovery through account.live.com/acsr and fear permanent loss of access.
• The attacker used your Outlook to attempt business email compromise fraud against a client or supplier.
• You want a full security audit of your devices, OneDrive, and every linked account after the incident.

IT Cares connects remotely, walks you through Microsoft's recovery process, strips out malicious inbox rules and forwarding, sets up two-step verification correctly, and secures your linked accounts — same day, anywhere in Canada.