Sending, receiving, and organizing email in Outlook.com
Report each message as phishing rather than trying to block your own address; Outlook.com can receive mail with a spoofed From address, and inbox rules may not process messages that the junk filter has already moved.
Report the spoofed messages
In Outlook.com:
- Select the message in Junk Email without opening links or attachments.
- Select Report → Report phishing.
- Repeat for several examples if they differ.
Reporting removes the selected message and provides Microsoft with information used to improve its filtering. Reporting does not immediately block future messages, so some may continue to reach Junk while the filtering system evaluates them.^1^
Do not reply or use an “unsubscribe” link in these messages; responding can confirm that your address is active.^2^
Why blocking and the rule do not work
The address displayed beside From is not proof that the message was sent through your account. Spammers can place your address in that field while sending from another source. Outlook may show an unverified-sender indicator or detect that the real address differs from the displayed address.^3^
Outlook.com cannot block your own address because it is also your legitimate sending identity. Additionally, rules created under Settings → Mail → Rules may not catch these messages: mail classified as spam can be moved to Junk before inbox rules run.^4^
If the messages share a stable phrase, fake company name, or domain in their content, a rule based on that text may catch messages that reach rule processing:
- Open Settings → Mail → Rules.
- Edit the existing rule rather than recreating the unsuccessful “From me” rule.
- Match a distinctive phrase or domain appearing in every spam message.
- Set the action to Delete.
- Enable Stop processing more rules, if offered.
This remains a partial workaround because messages routed directly to Junk may bypass it.
Check whether this is only spoofing
Receiving mail that displays your address does not by itself establish that someone accessed your account. Check for stronger evidence:
- Open your Microsoft account’s Recent activity page.
- Look for successful sign-ins, locations, or devices you do not recognize.
- In Outlook.com, open Settings → Mail → Rules and remove any rule you did not create.
- Open Settings → Mail → Forwarding and remove any forwarding address you did not add.
Microsoft documents Recent activity as the place to review successful sign-ins and security challenges.^5^
If there are unrecognized successful sign-ins, sent messages you did not send, or unauthorized forwarding/rules:
- Change the Microsoft account password to a new, unique password.
- Turn on two-step verification.
- Sign out unknown sessions and secure the recovery email address and phone number.
If none of those signs exists, changing the password repeatedly will not stop address spoofing; continue reporting the messages and let them remain isolated in Junk.
References