Email hacked.

Use Outlook.com on a PC or Mac to open Deleted Items → Recover items deleted from this folder; this is the remaining supported recovery location after messages have been removed from Deleted Items.

Recover the deleted messages

1. Sign in to Outlook.com from a desktop browser. The Recoverable Items folder cannot be accessed from a mobile browser or the Outlook mobile apps.
2. Select Deleted Items in the left pane.
3. At the top of the message list, select Recover items deleted from this folder or Recover.
4. Select the messages, then choose Restore. Use Ctrl+click for individual messages or Shift+click for a range.
5. Also inspect Archive, Junk Email, and any custom folders in case the attacker moved rather than deleted messages.

For Outlook.com, messages removed from Deleted Items remain recoverable for 30 days. If they are not shown in Recoverable Items, they have probably been permanently removed and cannot be restored through Outlook.com’s recovery controls.^1^

Since recovery has already been attempted, if that included Recover items deleted from this folder on a computer and nothing appeared, move directly to support:

1. In Outlook.com, select Help on the menu bar.
2. Enter a description such as “Messages deleted after account compromise.”
3. If self-help does not resolve it, scroll to Still need help? and select Yes to request Outlook.com support.^2^

Remove anything the attacker left behind

Regaining access alone may not remove altered mailbox settings. Microsoft’s compromised-account procedure specifically calls for checking connected accounts, forwarding, and automatic replies.^3^

In Outlook.com, check:

• Settings → Mail → Rules: delete rules you did not create, especially rules that delete, archive, or redirect mail.
• Settings → Mail → Forwarding: remove unknown forwarding addresses and disable forwarding if unnecessary.
• Settings → Mail → Automatic replies: remove any message added by the attacker.
• Settings → Mail → Message handling: clear Empty my deleted items folder if it is enabled, so signing out does not empty that folder.^4^

Secure the Microsoft account

1. Run a full, updated antivirus or malware scan on every computer used with the account. Microsoft recommends doing this before changing the password.^3^
2. If the password was changed before scanning, change it again afterward to a new, unique password.
3. Open the Microsoft account Recent activity page and review the last 30 days. Expand unfamiliar entries and select This wasn’t me where available.
4. Remove unknown trusted devices and security information, then enable two-step verification. Microsoft recommends changing the password and updating security settings when unauthorized access is suspected.^5^
5. Change the password on any other account where the same password was reused.

Warn contacts that the money requests were fraudulent and ask them not to reply, click links, or send money. If anyone paid, they should immediately contact their bank or payment provider and report the fraud to the appropriate local authority.

References

1. [Web](https://support.microsoft.com/outlook/mail/recover-and-restore-deleted-items-in-outlook)
2. Email is missing from your Outlook.com inbox | Microsoft Support
3. How to recover a hacked or compromised Microsoft account
4. Working with message folders in Outlook.com | Microsoft Support
5. Check the recent sign-in activity for your Microsoft account