Repeated attempts to hack my account

For a personal Microsoft account, create a new private alias and disable sign-in for the old address—changing the password or primary email alone does not prevent attempts against an old alias that remains enabled for sign-in.^1^

Personal Microsoft account

1. Sign in to your Microsoft account and open Your info → Manage how you sign in to Microsoft.
2. Select Add email and create a new Outlook.com address that is difficult to guess and used only for signing in.
3. Verify the address, then select Make primary beside it.
4. Open Change sign-in preferences.
5. Enable the new alias for sign-in and clear the checkbox beside the old, publicly known address.^2^
6. Do not delete the old alias. Keeping it attached lets you continue receiving mail through it. Microsoft aliases share the same contacts, storage, subscriptions, account settings, and password.^3^
7. Keep the new sign-in alias private; do not use it for ordinary email, websites, or mailing lists.

This differs from merely changing the primary address: the exposed address must also be disabled under Change sign-in preferences.

Check whether access actually succeeded

Open the Microsoft account Security page and select Review activity. Expand unfamiliar events:

• Incorrect password entered means Microsoft rejected the attempt.
• For an event under Unusual activity, select This wasn’t me.
• For suspicious entries under Recent activity, select Secure your account.
• If there is an unfamiliar Successful sign-in, treat the account as compromised.^4^

Since passwords have already been changed repeatedly, another change is unnecessary when the history contains only rejected attempts. If it shows an unauthorized successful sign-in:

1. Run a full malware scan on devices used with the account.
2. Change the password from a known-clean device.
3. Review security information, connected applications, forwarding rules, and automatic replies.^5^
4. Go to Security → Advanced security options → Sign out everywhere → Sign out. Microsoft says sign-out can take up to 24 hours and does not include Xbox consoles.^6^

Never approve an Authenticator request you did not initiate. Two-step verification prevents access when an attacker lacks the second verification method; retain multiple recovery methods so loss of one does not lock you out.^7^

Work or school account

Alias and sign-in-name changes are controlled by the organization, so contact the IT help desk rather than changing personal-account alias settings.

1. Open My Account → Recent Activity and inspect each event’s application, browser, operating system, and status—not only its approximate location.
2. If an unfamiliar event succeeded, update the security methods and notify IT immediately.
3. If an entry says Additional verification failed, invalid code, the password succeeded but MFA blocked the attempt; change the password and update security information.^8^
4. Ask an administrator to inspect the Microsoft Entra sign-in logs. If compromise is suspected, an Authentication Administrator can use Entra ID → Users → your account → Authentication methods to Revoke sessions or Require re-register MFA.^9^

References

1. I am still receiving unexpected sign in request authentication even after changing password - Microsoft Q&A
2. Need Assistance With Security After Attempted Logins From Strangers - Microsoft Q&A
3. Change the email address for your Microsoft account | Microsoft Support
4. Check the recent sign-in activity for your Microsoft account
5. How to recover a hacked or compromised Microsoft account | Microsoft Support
6. How to sign out of your Microsoft account everywhere | Microsoft Support
7. How to use two-step verification with your Microsoft account | Microsoft Support
8. View your work or school account sign-in activity from My Sign-ins | Microsoft Support
9. Manage user authentication methods for Microsoft Entra multifactor authentication