A tool for managing user identities, credentials, and access across on-premises and cloud environments
This pattern usually means the attacker left mailbox settings behind after the password change, or the account is still under a temporary protection block.
- In Outlook.com on a computer, open Settings and check Mail > Rules.
- Delete any rule that is not recognized.
- Attackers commonly create rules that move mail to Deleted Items, Junk Email, Notes, or RSS Subscriptions.
- Check Mail > Forwarding and confirm forwarding is not enabled to an unknown address.
- Check IMAP settings and remove anything that should not be there.
- Review Deleted Items, Junk Email, and recover deleted items if needed.
- Since replies are already landing in Deleted Items, a malicious rule is a strong indicator.
- Review recent sign-in activity for the Microsoft account.
- Use the Recent activity page to see sign-ins from the last 30 days and confirm whether there was unauthorized access.
- Check account sign-in and security details.
- Review aliases and remove any that are not recognized.
- Confirm recovery and contact information is correct.
- Remove existing app passwords.
- Remove devices that are not recognized.
- Use Sign out everywhere. This can take up to 24 hours to take effect.
- Change the password again and enable two-step verification if it is not already enabled.
- Check whether the mailbox or Microsoft cloud storage is full.
- If storage is full, Outlook.com cannot send or receive email.
- Messages sent while storage was full are bounced back to the sender and are unrecoverable.
- If the account was temporarily blocked because of unusual sign-in activity, unblock it by resetting the password.
- If sign-in or unblocking still fails, use the Microsoft account sign-in helper or the account recovery flow.
If mail still does not arrive after removing rules, disabling forwarding, signing out everywhere, and confirming storage is not full, contact Outlook.com support from the Outlook.com help flow.
References:
- Can't send or receive email in Outlook.com | Microsoft Support
- Email is missing from your Outlook.com inbox | Microsoft Support
- Respond to a compromised cloud email account
- Unblock my Outlook.com account | Microsoft Support
- After I got hacked, I changed password now I'm not receiving emails. - Microsoft Q&A
- My email was hacked - Microsoft Q&A
- Email hacked now do not receive emails - Microsoft Q&A
- Hacked not receiving emails - Microsoft Q&A
- Outlook incoming emails - Microsoft Q&A