Hackers email still on my sign in page

Question

Hackers email still on my sign in page

Leo Jay 0

We were hacked, they managed to change the password, but thankfully we still have the same phone #. the hackers e-mail is still on the sign in page. Is this person trackable, and how do we remove the bogus hackers e-mail from the sign on page

0 comments

2 answers

Your answer

Answer 1

Hello,

When you say the hacker's email is still on the sign-in page, do you mean it appears as the email address used to sign in to your Microsoft account, or does it appear as a security verification method?

1

Start an InPrivate Window.

Sign in with your Microsoft Account on the 'Manage how you sign in with your Microsoft Account' page:

https://account.live.com/names/manage

If you see the hacker's email address in the list under the 'Account Username' section, select the account you want to remove, then click 'Remove'.
Make sure you are not removing your Microsoft domain email address from the lists.

2

If you don't see the hacker's email address on the Alias page, sign in to the security settings page here:

https://account.live.com/proofs/Manage

If the hacker's email address is on the security settings page, remove the verification method there.
From the security settings page of your Microsoft Account, add a new recovery email address, add an Authenticator verification method, and enable 2FA for added security.
Since Microsoft is phasing out the Phone number verification method, it is recommended to have at least three verification methods to prove your identity.

If you are still having issues, please post a screenshot that shows the hacker's email address.

If it is on the web browser, you may also try clearing your browsing history, cache, and cookies.

Answer 2

If the attacker’s email still appears on the sign-in page, the account’s sign-in alias or security info may have been changed.

Check whether the account is in a security info change pending state. On the Microsoft account Security page, if Your security info change is still pending appears:
- Select cancel this request only if the change was initiated by the legitimate account owner and access to the existing security proofs is still available.
- Select let us know if the change was not made by the legitimate account owner. Microsoft states that when all security info is removed, the account can be placed in a restricted state for 30 days, and this process cannot be expedited unless the request is canceled.
If access is available to Manage how you sign in, remove any alias that is not recognized. Only remove aliases that are confirmed not to belong to the legitimate account owner.
Review the account’s Recent activity page and expand each sign-in item. If unfamiliar successful sign-ins or unusual activity appear, change the password immediately and update security settings.
Go to Security settings and update security information so verification methods point only to trusted methods. If possible, add stronger verification such as two-step verification.
Remove any unrecognized devices and use Sign out everywhere so existing sessions are terminated.
If Outlook.com mail was affected, check for malicious mailbox changes:
- Settings > Mail > Rules
- Check Forwarding and IMAP Remove anything not recognized.

About tracking the attacker: the available guidance supports reviewing Recent activity to see sign-in details such as approximate location, browser, operating system, and app used. It does not provide a way to identify or track the person directly.