Potentially Hacked Account

Question

Potentially Hacked Account

Greg 0

I keep getting requests from different locations around the world to approve an authentication that I did not initiate. I reset my microsoft password, but the requests are continuing. Is this some sort of larger scale hack? What can I do to stop these unauthorized authentication requests?

0 comments

1 answer

Your answer

Answer 1

Repeated approval prompts from different locations usually mean someone knows the sign-in address and is repeatedly trying to sign in or trigger verification. A password change alone does not always stop the prompts.

Recommended actions:

Do not approve any unexpected prompt. If a prompt was not initiated intentionally, deny it.
Review recent sign-in activity. For a personal Microsoft account, go to the Recent activity page and review sign-ins from the last 30 days. If there is an Unusual activity section, mark entries as This was me or This wasn't me.
Change password and update security settings. Go to the Security settings page and:
- change the password to a strong, unique password
- update security settings
- remove trusted devices if needed
Add or update recovery and verification methods. On Advanced security options, select Add a new way to sign in or verify and make sure phone numbers or email addresses used for verification are current.
Consider going passwordless. On Additional security options, under Passwordless account, select Turn on and approve the request in Microsoft Authenticator. Supported passwordless methods include Microsoft Authenticator, Windows Hello, physical security keys, or SMS codes.
Scan the PC for malware before changing credentials again. Run a full antivirus scan first. In Windows Security, open Virus and threat protection > Scan options > Full scan > Scan now.
If the prompts keep coming, change the sign-in alias used for login. Accepted Microsoft Q&A guidance for this exact symptom is to add a new alias, make it the primary alias, and then disable sign-in for the old alias instead of deleting it. This can stop repeated prompts against the old sign-in name while still allowing it to receive mail.
If the account may already be compromised, use the sign-in helper tool. The account recovery flow can provide self-help steps or route to an agent.

This does not by itself prove a larger Microsoft-wide hack. It is consistent with repeated unauthorized sign-in attempts against a known account identifier.