How to secure microsoft hackers attempts tag: hackers

For a personal Microsoft account, create a private sign-in alias and disable sign-in for the publicly known email address without deleting it; the old address will continue receiving email but can no longer be used to initiate account sign-in attempts.^1^

1. Stop attempts against the known email address

1. Manually enter https://account.live.com in your browser and sign in. Do not use links in unexpected messages.
2. Select Your info > Sign-in preferences.
3. Under Account aliases, add a new Outlook.com alias.
4. Select Make primary beside the new alias.
5. Select Change sign-in preferences.
6. Enable the new alias and clear the checkbox for the old address, then save.
7. Do not delete the old alias. You can continue using it to send and receive email.
8. Keep the new alias private—use it only for signing in, not for newsletters, websites, or correspondence.

Attempts using the old address should then receive an error rather than trigger codes.^2^

An unrequested code does not by itself prove that the account was breached. Someone may be trying to access the account or may have entered the wrong email address. Never share the code or approve an unexpected Authenticator prompt.^3^

2. Check whether anyone actually signed in

Open the Microsoft account Security page by manually entering https://account.microsoft.com/security, then:

1. Select Review activity.
2. Expand unfamiliar entries and inspect more than the approximate location; identify the device, browser, and application.
3. For activity you did not authorize, select This wasn’t me or Secure your account, whichever is displayed.
4. If there is an unfamiliar successful sign-in, change the password immediately to a new, unique password.^4^

Codes with only unsuccessful activity generally indicate that the attempt was blocked. A successful sign-in that was not yours indicates that the account needs recovery and further review.

3. Strengthen authentication

From Security > Manage how I sign in:

• Turn on Two-step verification under Additional security.
• Prefer Microsoft Authenticator, Windows Hello, or a physical security key.
• Keep multiple current recovery methods so losing one device does not lock you out.

Microsoft is phasing out SMS authentication and recovery for personal accounts. Two-step verification prevents a password alone from granting access.^5^

For stronger protection, Microsoft also supports a passwordless account:

1. Open Additional security options.
2. Under Passwordless account, select Turn on.
3. Complete verification and approve the request in Microsoft Authenticator.^6^

4. If an unauthorized sign-in succeeded

Before changing the password, scan the Windows PC:

1. Save all open files.
2. Open Windows Security > Virus & threat protection.
3. Select Scan options > Full scan > Scan now.
4. If malware exposure is suspected, subsequently choose Microsoft Defender Antivirus (offline scan). This restarts the PC and scans outside normal Windows; results appear under Protection history.^7^
5. After the scan, change the password and check Outlook connected accounts, forwarding rules, and automatic replies.^8^

If codes continue after changing the sign-in alias

The old address may have been mistakenly entered as security information for somebody else’s account. If so, changing your own account cannot stop those messages: there is no self-service action available, and the codes will continue until that person corrects or removes your address.^1^

The private-alias procedure stops attempts directed at your personal Microsoft account; it cannot stop codes generated for a different account that incorrectly lists your email.

For a work or school account, the personal-account alias procedure does not apply. Review My Account > Recent Activity; if an entry says “Additional verification failed, invalid code,” the password succeeded but MFA blocked the attempt, so change the password and update the registered security methods. Contact the organization’s IT administrator to inspect Microsoft Entra sign-in logs if attempts persist.^9^

References

1. Repeated One-Time Verification Codes Sent to My Email - Microsoft Q&A
2. Repeated Unwanted Microsoft Authenticator Login Prompts - Microsoft Q&A
3. Why is Microsoft texting me? | Microsoft Support
4. What happens if there's an unusual sign-in to your account | Microsoft Support
5. How to use two-step verification with your Microsoft account
6. How to help keep your Microsoft account secure
7. Virus and Threat Protection in the Windows Security App | Microsoft Support
8. How to recover a hacked or compromised Microsoft account | Microsoft Support
9. View your work or school account sign-in activity from My Sign-ins | Microsoft Support