Check and remove unauthorized inbox rules or forwarding in Outlook.com first, because compromised-account settings can silently move, delete, or redirect only some incoming messages.
1. Remove unauthorized mail controls
Use a computer and sign in to Outlook.com in a browser:
- Select Settings (gear) → Mail → Rules.
- Delete any rule you did not create, particularly rules that:
- delete messages;
- move messages to another folder;
- mark messages as read;
- redirect messages.
- Go to Settings → Mail → Forwarding.
- Turn forwarding off if you did not enable it, and remove any unfamiliar forwarding address.
- Also review Settings → Mail → Automatic replies and any connected accounts for unauthorized changes.
Microsoft specifically recommends reviewing forwarding and related account settings after an account has been compromised.^1^ Rules must be viewed and edited from a computer.^2^
2. Find messages that were diverted
Check these locations in Outlook.com:
- Junk Email: select legitimate messages, then Report → Not junk.
- Other tab: move legitimate messages to Focused.
- Deleted Items: select missing messages and choose Restore.
- At the top of Deleted Items, select Recover items deleted from this folder. Recoverable items remain available there for up to 30 days.
- Archive and any unfamiliar folders.
- Above the message list, select Filter → All, then Filter → Sort → Date.
These are the documented locations and controls for messages missing from an Outlook.com inbox.^2^
3. Check storage and blocked senders
Open Outlook.com settings and review mailbox/storage usage. If Microsoft cloud storage is full, Outlook.com cannot receive mail; messages sent while it was full are bounced to senders and cannot be recovered.^3^
Also review Settings → Mail → Junk email:
- Remove legitimate addresses or domains from Blocked senders and domains.
- Add important senders to Safe senders and domains if their messages are consistently going to Junk. Safe-listed messages are directed to the inbox.^4^
4. Secure the account completely
If this was not already completed after the suspicious activity:
- Run a full malware scan on every computer used with the account.
- Change the Microsoft account password from a clean device.
- Review the account’s Recent activity. It displays sign-ins from the previous 30 days, including device or application details.^2^
- Correct the recovery email address and phone number if necessary.
- Enable two-step verification.
Microsoft’s compromised-account procedure places a full malware scan before changing the password so that new credentials are not exposed again.^1^
5. Test delivery and escalate if necessary
After making the changes:
- Ask two people using different email providers to send new messages with unique subjects.
- Check Inbox, Other, Junk, Deleted Items, and Recover items deleted from this folder.
- Ask whether either sender received a non-delivery report. If only one sender or domain fails and no error appears in Outlook.com, Microsoft recommends having that sender use Outlook.com Sender Support.^3^
- If multiple unrelated senders still fail after the checks, sign in to Outlook.com, select Help (?), describe the delivery problem, and scroll to Still need help? → Yes to contact Outlook.com support. Support can investigate an account-level delivery restriction that cannot be removed through mailbox settings.^3^
References
- How to recover a hacked or compromised Microsoft account | Microsoft Support
- Email is missing from your Outlook.com inbox | Microsoft Support
- Can't send or receive email in Outlook.com | Microsoft Support
- Help protect your Outlook.com email account | Microsoft Support