someone has taken over my account

Secure the account from a trusted computer by scanning it for malware, changing or resetting the password, removing unauthorized account changes, and signing out every active session.

1. Regain and secure access

1. Do not click links in the Microsoft 365 subscription messages.
2. On Windows, open Windows Security → Virus & threat protection → Scan options → Full scan → Scan now. Microsoft recommends completing the malware scan before changing the password, so malware cannot capture the new one.^1^
3. After the scan:
   • If you can sign in, change the password from the Microsoft account Security page. Use a new password that has never been used on another account.
   • If you cannot sign in, use Microsoft’s Sign-in Helper from the compromised-account recovery page. It can direct you to self-service recovery or an available support option.^1^
4. Review Recent activity. It shows the last 30 days of sign-ins. Expand unfamiliar entries and select This wasn’t me where that option appears.^2^
5. In the account’s Advanced security options, review the recovery email addresses, phone numbers, and other sign-in methods. Remove anything you do not recognize, then enable two-step verification or Microsoft Authenticator.^3^
6. Select Sign out everywhere under Advanced security options. Microsoft says browsers and apps can take up to 24 hours to be signed out; Xbox is excluded.^4^

2. Remove changes made inside Outlook.com

In Outlook.com, select the gear icon → Settings, then inspect:

• Mail → Rules: delete rules you did not create.
• Mail → Forwarding: remove unauthorized forwarding.
• Mail → Automatic replies: remove unfamiliar messages.
• Mail → Junk email: review blocked and safe senders.
• Your Microsoft account’s aliases, connected applications, and devices: remove only entries you do not recognize.

Microsoft specifically recommends checking connected accounts, forwarding, and automatic replies after account compromise.^1^

Do not delete an address or recovery method you recognize until another valid recovery method is working.

3. Restore English

In Outlook.com, open:

Settings → General → Language and time → Language → English → Save

That is the documented Outlook.com location for its language setting.^5^

If the foreign-language menus make navigation impossible, go directly to the Outlook.com Language and time settings page:

https://outlook.live.com/mail/0/options/general/timeAndLanguage

Choose English from the first language list and save. This direct route has been used for the same Outlook.com compromise-and-language-change situation.^6^

4. Handle the Microsoft 365 messages

An unexpected subscription or invoice message might be phishing rather than proof that a subscription was created.

• Do not reply, open attachments, call numbers in the message, or use its links.
• In Outlook.com, select the message and choose Report → Report phishing. Reporting removes it and submits it to Microsoft, but does not automatically block future mail from that sender.^7^
• Check subscriptions and billing only by signing in directly to the Microsoft account—not through the message.
• If an unfamiliar charge appears on a bank or card statement, contact the financial institution immediately.

If recovery fails

Use the Microsoft account recovery form guidance. Results are sent to the working contact email supplied on the form, generally within 24 hours, and another attempt can be made up to twice per day if Microsoft cannot verify ownership. Support agents cannot manually access the account or change its details.^8^

References

1. How to recover a hacked or compromised Microsoft account
2. What is the Recent activity page? | Microsoft Support
3. How to help keep your Microsoft account secure | Microsoft Support
4. How to sign out of your Microsoft account everywhere | Microsoft Support
5. Settings by category
6. My Hotmail is hacked and I’m Chinese language - Microsoft Q&A
7. Phishing and suspicious behavior in Outlook | Microsoft Support
8. Help with the Microsoft account recovery form | Microsoft Support