Blue Hat Web

Hacked Outlook or Microsoft account: the recovery steps

· 4 min read

To recover a hacked Microsoft account, Microsoft advises scanning your computer for malware first, then changing or resetting your password, then checking connected accounts, forwarding, and automatic replies. If you are locked out, Microsoft’s recovery form is the fallback, but it does not work when two-step verification is on. Work accounts in Microsoft 365 are recovered by your administrator.

How to recover a hacked Outlook or Microsoft account

Follow Microsoft’s order: clean your computer, change the password, then check what the attacker changed. If you cannot sign in, tell Microsoft that someone else is using your account and, if needed, use its recovery form. These steps are the Microsoft side of recovering a hacked account, and Microsoft describes them on its page on recovering a hacked or compromised Microsoft account.

Microsoft’s help pages give fewer details than Google’s, and some steps have no published menu path. The paths below are those Microsoft published on November 10, 2026.

Microsoft’s three steps

  1. Remove malware first. Microsoft advises a full scan with up-to-date security software before you change your password; malicious software still on the computer could otherwise capture the new one.
  2. Change or reset your password. If you can sign in, change it; if not, reset it.
  3. Check what was changed. Microsoft says it resets some account settings after a compromise, and asks you to check connected accounts, forwarding, and automatic replies.

If you can still sign in

  • Review recent activity. On the Security basics page, choose Review activity, or go to account.live.com/Activity. It shows sign-ins from the last 30 days, though Microsoft notes it does not show all activity. Mark anything unfamiliar as This wasn’t me.
  • Turn off forwarding. In Outlook.com, open Settings, Mail, Forwarding and IMAP, then disable forwarding and save. In the new Outlook and Outlook on the web, the setting is under Settings, Mail, Forwarding.
  • Check your rules. Forwarding can also hide in an inbox rule: Settings, Mail, Rules. Remove any rule that forwards, redirects, or deletes mail you did not set up.
  • Sign out everywhere. In your account’s security settings, under additional security options, choose Sign out everywhere. Microsoft says it can take up to 24 hours to take effect.
  • Turn on two-step verification with Microsoft Authenticator or a passkey, and check your recovery email and phone number.

If you are locked out

On the sign-in page, choose Forgot my password, then I think someone else is using my Microsoft account. If that does not work, Microsoft’s account recovery form, at account.live.com/acsr, is the fallback, with three conditions from the form itself:

  • it cannot be used if two-step verification is on;
  • you need a contact email address different from the one you are recovering;
  • you should answer from a device and location you have used with the account, and guess rather than leave blanks.

Microsoft says it reviews answers within 24 hours. If two-step verification is on and you have no other way to verify, Microsoft says it cannot help. Replacing all your security info is possible with your password, but you then wait 30 days before signing in. A recovery code generated in advance avoids most of this.

If it is a work account in Microsoft 365

Microsoft’s consumer support cannot help with a work or school account: the administrator of your organization handles it. Microsoft’s guide for administrators lists the signs, such as rules that move mail to the Notes, Junk Email, or RSS Subscriptions folders, messages sent without the user’s knowledge, or recent external forwarding, and the steps:

  1. disable the account until the investigation is done;
  2. revoke its sessions;
  3. review its multifactor authentication methods, the apps it consented to, and any admin roles;
  4. review forwarding and inbox rules, including hidden ones;
  5. reset the password, and do not send the new one by email, since the attacker may still read the mailbox.

One difference from Google matters: in Microsoft 365, resetting a password does not automatically revoke app passwords; they must be deleted and recreated. If the account sent spam, it may also be blocked from sending until an administrator releases it.

The Google side

If you also use Gmail or Google Workspace, the steps and waiting times differ. See how to recover a Google account.

Social media linked to this address

If your business pages use this email address to sign in, check them next. Our guide to recovering Facebook and Instagram business accounts explains the process.

Blue Hat Web