My account has been compromised. Recovered it, but a auto-forward rule keeps appearing

RH 0 Reputation points
2026-11-11T21:49:27.83+00:00

My account has been compromised. I have recovered it, reset the password, put 2FA in place and remove all devices with access rights. However, an autoforward rule keeps appearing. Everytime I delete the rule or deactivate it, another rule is created

Outlook | Web | Outlook.com | Account management, security, and privacy

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. EmilyS726 279.7K Reputation points Independent Advisor
    2026-11-11T22:31:50.2766667+00:00

    Hello,

    I am going to share with you a comprehensive list of things to do. Please feel free to skip any steps you have already completed, except the first step, which is very important.

    Please complete these steps on a computer, not on a smartphone or tablet.

    Step 1: Sign out everywhere FIRST

    Go to https://account.microsoft.com/security and sign in.

    Go to Manage how I sign in, scroll down, and click Sign out everywhere.

    This is intended to disconnect any active sessions that may still have access to your Microsoft account.

    IMPORTANT: This process can take up to 24 hours to fully take effect. This means someone who is already signed into your account may not be disconnected immediately. Please do not expect immediate result without waiting the full 24 hours.

    Continue the following after the 24-hour wait is over.

    ====================

    Step 2: Review your Outlook settings

    Go to https://www.outlook.com and sign in.

    Click the gear icon in the top right corner to open Settings.

    Under Mail, review the following areas:

    Rules

    If any rules are listed that you did not create, delete them. If you do not use rules at all, you can delete all of them.

    Conditional formatting

    If anything is set up there that you did not create, delete it.

    Forwarding and IMAP

    If you see any entries or settings you did not create, remove them. Turn off POP and IMAP if you do not use them.

    Junk

    Review your Safe senders and Blocked senders lists. Remove any unfamiliar entries from the Safe senders list.

    After that, exit Settings and return to Outlook.com.

    Open the To Do section by clicking the blue checkmark icon on the left side. Delete anything there that was not created by you.

    ====================

    Step 3: Review your Microsoft account

    Go to https://account.live.com.

    Under Your info > Sign-in preferences, review all aliases on your account. If you see any alias you do not recognize, remove it. Be careful not to delete any legitimate email address you still use.

    Next, go to the Devices section of your Microsoft account and remove any devices you do not recognize.

    ====================

    Step 4: Secure your account

    Go to the Security section of your Microsoft account.

    Change your password to a new, strong password that you have never used before.

    Enable two-step verification.

    Go to Manage how I sign in and make sure all security contact information belongs to you.

    On that same page, scroll down to App passwords and remove any existing app passwords you do not need.

    ====================

    Step 5: Review app permissions

    Go to https://account.microsoft.com/privacy/app-access.

    Review the apps that have permission to access your Microsoft account.

    Click Don't allow for anything you do not recognize or no longer use.

    ==============

    Step 6: Remove hidden rules.

    If you use Classic Outlook on any Windows device, do this on those devices

    Close Outlook completely.

    Press Win + R on your keyboard to open the Run dialog.

    Type outlook /cleanrules and press Enter to clear and reset client-side rule stores

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.