Managing personal Outlook.com account settings, security, and privacy
Create an Outlook.com rule that deletes messages whose subject contains “YOU GOT RECORDED”, because sender blocking is ineffective when the displayed address changes or conceals the real sending address.^1^
Create the subject-based rule
Since the sender filters you applied did not work, do not create another rule based on the From address—especially because the messages display your own address.
- Sign in to Outlook.com in a web browser.
- Select Settings (gear icon) → Mail → Rules.
- Select Add new rule.
- Enter a name such as
Delete recorded-message scam. - Under Add a condition, select Subject includes.
- Enter:
YOU GOT RECORDED - Under Add an action, select Delete or Move to Deleted Items.
- Enable Stop processing more rules.
- Select Save.
- On the Rules page, use Run rule now if available to process matching messages already in the mailbox.
Outlook.com rules can delete or move incoming messages according to specified criteria, and their order controls which rule runs first.^2^
Start with the complete phrase rather than broad words such as “recorded” or “video,” which could remove legitimate mail. If the criminals later alter the subject, edit the rule and add another distinctive phrase.
Deleting automatically carries some risk of removing a legitimate message with the same subject. Initially moving matches to a separate folder is safer; after testing, change the action to Delete.
Why your earlier blocking did not last
The messages marked Unverified may be hiding or spoofing the visible sender address. Outlook can show a displayed address that differs from the actual sender, and spammers can continually change addresses.^3^
Also, adding an address or domain to Outlook’s blocked list normally routes matching mail to Junk Email; it is not a universal rejection mechanism for every newly created or disguised sender.^4^
Continue using Report → Report phishing for new variants. Reporting sends information to Microsoft, but Microsoft explicitly notes that reporting a message does not itself block subsequent messages.^3^
Do not reply, open attachments, click links, pay money, or provide passwords or security codes.
Check whether the account was actually accessed
Seeing your own address in the From field does not by itself prove that someone entered your account. Check for independent evidence:
- Open the Microsoft account Recent activity page from your account’s Security settings.
- Review successful sign-ins, devices, applications, and locations.
- If every successful sign-in is yours, continue using the subject rule; changing the password solely because of the displayed sender is not established as necessary.
- If you find an unauthorized successful sign-in:
- Run a full antivirus scan first.
- Change the Microsoft account password.
- Review connected accounts, forwarding, and automatic replies.
- Enable two-step verification.
Microsoft’s compromised-account procedure specifies scanning before changing the password and then reviewing account settings that an intruder could have modified.^5^
No mailbox setting can guarantee that criminals will never attempt to send another message. The durable approach is to filter the repeated content, report new variants, and separately secure the account if Recent activity shows genuine unauthorized access.
References