Outlook account hacked? How to recover your Microsoft account

If your Outlook.com or Microsoft account was hacked, scan your computer for malware first, then change your password at account.microsoft.com or reset it at account.live.com/password/reset if you are locked out. After that, sign out everywhere, remove security info you did not add, and check forwarding, inbox rules and automatic replies, which Microsoft asks you to check yourself.

These are Microsoft's own steps, checked on its support site on November 6, 2026. They apply to Outlook.com, Hotmail and Live addresses, which are all Microsoft accounts.

Signs your Outlook account was hacked

Microsoft's Recent activity page shows where your account was used in the last 30 days. Look there if you notice any of these:

• Friends say they got strange mail or links from you.
• Your password stopped working.
• You get an unusual activity email from Microsoft.
• Your security email or phone changed, or mail stopped arriving.

Two cautions from Microsoft. Mobile networks route traffic through different places, so a sign-in can look like it came from somewhere you were not. And if an email about unusual activity looks suspicious, you can always sign in to your account directly instead of clicking its links. Microsoft also says it never asks for your password in email.

Step 1: Scan your computer first

Microsoft's hacked account page puts this before the password change, on purpose. If the device has a keylogger, the new password goes straight to the attacker.

On Windows:

1. Open Windows Security.
2. Go to the Virus and threat protection tab.
3. Select Scan options, then Full scan, then Scan now.

Microsoft says to run a full scan with whatever antivirus you use before changing the password.

Step 2: Change or reset your password

If you can still sign in, Microsoft's change password page gives these steps:

1. Sign in at account.microsoft.com.
2. Go to Security and select the Change password link at the top of the page.
3. Enter your new password.
4. Select Save.

Use a password you have never used on any other site.

If the hacker changed your password, follow Microsoft's password reset steps:

1. On the sign-in page, select Forgotten your password?, or go to account.live.com/password/reset.
2. Enter the account's username and select Next.
3. Choose where to receive a verification code and select Next.
4. Confirm the hinted email or last four digits of the phone, and select Get code.
5. Enter the code, select Next, type your new password, and select Next.

If you do not recognize the email or phone options shown, which is common when a hacker swapped them, Microsoft points you to its sign-in helper tool instead. That tool asks for your email address or phone number, then shows self-help or offers the chance to talk to an agent. If it cannot get you in, go to the recovery form further down.

Step 3: Sign out everywhere

If you think someone might still have access, Microsoft's sign out everywhere page has the fix:

1. Sign in to Additional security options on your Microsoft account security dashboard.
2. Scroll down to Sign out everywhere and select Sign out.

Microsoft says this can take up to 24 hours, and it signs you out of browsers, apps and everywhere else except an Xbox console, which you sign out of separately.

Step 4: Check your security info and recent activity

Hackers often add their own email or phone so they can reset your password again later.

Review recent activity. Open account.live.com/Activity. If there is an Unusual activity section, expand each item and choose This was me or This wasn't me. Microsoft says to pick "This wasn't me" if you are not sure, and it will then walk you through changing your password and updating your security info. Microsoft also notes it does not show every event, mostly the significant ones.

Remove methods you did not add. From Microsoft's removal steps:

1. Sign in to the Additional security options page.
2. Expand the verification option and select Remove.
3. Tick the checkbox to acknowledge it, then select Schedule removal.

Know this: Microsoft schedules the removal 30 days out, and the method keeps working until then. Do not rely on it being gone right away. Changing your password and signing out everywhere still matter.

Add your own. Under Security, select Manage how I sign in, then Add a new way to sign in or verify. Microsoft allows up to 10 methods, including a backup email, an authenticator app or a passkey.

Step 5: Check forwarding, rules and automatic replies

Microsoft's hacked account page says that because someone else had access, it has reset some of your account settings, and it asks you to check connected accounts, forwarding and automatic replies yourself. Add inbox rules to that list.

Forwarding. In Outlook.com, select Settings, then Mail, then Forwarding. If Enable forwarding is checked with an address you do not know, clear it and select Save. Microsoft's forwarding page has the full steps. Our guide to checking if your email is being forwarded covers the warning signs.

Inbox rules. A rule can quietly forward, redirect or delete incoming mail, even when the Forwarding setting is off. From Microsoft's rules page, Outlook.com tab:

1. Select Settings, then Mail, then Rules.
2. On any rule you did not create, select More actions (the three dots), then Delete rule.

Automatic replies and connected accounts. Check that no automatic reply was set up in your name, and that no other mail account was connected to your mailbox.

Step 6: Turn on two-step verification

From Microsoft's two-step verification page: go to account.microsoft.com/security, select Manage how I sign in, and under Additional security and Two-step verification, choose Turn on.

Read the warning first. With two-step verification on, a password reset needs two contact methods, and losing one can take 30 days to fix or even cost you the account. Microsoft recommends keeping three pieces of security info on the account.

If you are locked out: the Microsoft account recovery form

When the reset and the sign-in helper both fail, Microsoft's last route is the account recovery form. Its guide to the form has the details that decide whether it works:

• A working contact email. Microsoft replies there. It can be any active address, even a friend's, or a new outlook.com account.
• Use a familiar device and place. Fill it in on a device you signed in with before, at home or work if you can.
• Answer everything. Guessing is fine, Microsoft says wrong answers do not count against you.
• Outlook.com details. Expect questions about contacts and email subject lines, and the subject lines need to be exact. Ask people you wrote to for help.
• Old passwords. List any you might have used, and check passwords saved in your browser.

Microsoft replies to the contact email within 24 hours. If it cannot verify you, you can try again, up to two times per day.

Two hard limits. If two-step verification was on and you cannot reach any of your alternate methods, Microsoft says it cannot help. And its support agents are not allowed to send password reset links or change account details for you, so anyone offering to do that by phone is not Microsoft.

Account blocked or locked? A blocked Outlook.com account after unusual sign-ins is unblocked through the Sign-in Helper. A locked Microsoft account is different: it means activity on the account, such as spam or phishing, may have broken Microsoft's terms. Use the aka.ms link shown in the sign-in window to request reinstatement, and do not send duplicate requests.

Tell your contacts and check other accounts

If your address sent spam, warn your contacts from a clean device: ignore recent messages from you, and do not click links or send money. Our post on what someone can do with your email address explains what scammers do next.

Then change the password on every other account that used the same one, starting with banking and anything that resets through this Outlook address. Check whether the address appeared in a leak with has my email been in a data breach, and if a link started it, see what to do if you clicked a phishing link.

If you want a fresh address

If the old address keeps getting targeted or is buried in spam, starting over is an option. Secria Mail sign-up is a name, the address you want and a password, with no phone number and no card. Give each site its own alias, so a leak shows you which site it came from and you can stop it by deleting that alias. You can import your old Outlook mail too. See Secria Mail or create an account.

Frequently asked questions

What should I do first if my Outlook account is hacked?

Scan your computer for malware, then change your password at account.microsoft.com. If you cannot sign in, reset it at account.live.com/password/reset or use Microsoft's sign-in helper.

The hacker changed my recovery email and phone. Can I still recover my Microsoft account?

Often, yes, through the account recovery form at account.live.com/acsr. Give a working contact email, answer as much as you can, and fill it in on a device and in a place you have used before. The exception is when two-step verification was on and you cannot reach any alternate method.

Does changing my Microsoft password log the hacker out?

Do not count on it. Use Sign out everywhere under Additional security options. Microsoft says it can take up to 24 hours.

Can Microsoft support recover my hacked account?

Microsoft's sign-in helper can route you to an agent, but agents cannot send password reset links or change account details. The recovery form is the official way back in.

How did my Outlook account get hacked?

Most often a reused password from another site's breach, or a fake sign-in page. Our guide to whether someone can hack your email covers the common routes, and what to do if your email is hacked has a checklist for any provider.