If an unfamiliar alternate email now appears on the Microsoft account, treat the account as compromised and secure it immediately.
- On the PC used with that account, run a malware scan before changing anything:
- Open Virus and threat protection.
- Select Scan options > Full scan > Scan now.
- This matters because changing the password first is not enough if malware is still present.
- Check whether the account is still accessible:
- Go to the Microsoft account Security basics page.
- Select Review activity and inspect recent sign-in attempts.
- If any activity is not recognized, expand it and select This wasn't me or Secure your account.
- If sign-in still works, change the password immediately:
- From Security basics, select Change password.
- Use a strong new password.
- Review account settings that attackers commonly change:
- Check connected accounts.
- Check forwarding.
- Check automatic replies.
- Remove anything unfamiliar.
- If sign-in does not work, use Microsoft’s recovery flow:
- Start with the sign-in helper tool for hacked or compromised accounts.
- If prompted during sign-in, select Forgot my password and then I think someone else is using my Microsoft account.
- Add or verify security info after access is restored:
- Add an alternate email address and mobile phone number that are actually controlled by the account owner.
- This helps with future recovery.
- If the account cannot be recovered through self-service, contact Microsoft Support using another Microsoft account and use Contact Support.
Do not post passwords, verification codes, payment details, or unknown recovery addresses publicly.
- How to recover a hacked or compromised Microsoft account | Microsoft Support
- How to recover a hacked or compromised Microsoft account | Microsoft Support
- What happens if there's an unusual sign-in to your account | Microsoft Support
- Check the recent sign-in activity for your Microsoft account
- Help protect your Outlook.com email account | Microsoft Support