Unauthorised email forwarding

Question

Unauthorised email forwarding

Lana Nadeen 0

I noticed today that I had email forwarding enabled to an email account I don't know. I have 2FA and you need a code to sign in to my account which gets set to my phone and I have to authorise. How has this happened?

0 comments

2 answers

Your answer

Answer 1

This can happen even with 2FA enabled if someone already gained access to the account, or if suspicious activity was approved through a sign-in or recovery flow. Microsoft’s guidance is that repeated unexpected prompts or unusual sign-ins can mean someone is trying to access the account, while your account remains protected if unrequested codes are not approved.

Since forwarding was enabled to an address that is not recognized, treat the account as compromised and secure it immediately:

Go to the Security basics page.
Select Review activity and check the Recent activity page for unusual sign-in attempts.
- If an entry is not recognized, select This wasn't me or Secure your account.
From Security basics, select Change password and set a new strong password.
Check account sign-in methods and remove anything unfamiliar.
Review mailbox settings for forwarding and rules, and remove any forwarding address or rule that was not created intentionally.
If sign-in no longer works, use Forgot my password and select I think someone else is using my Microsoft account.

Important points from Microsoft guidance:

Unrequested verification codes or prompts can happen because someone is trying to access the account, someone entered the wrong phone or email, or a previous code was delayed.
Do not approve codes or prompts that were not requested.
Support agents cannot send password reset links, verification codes, or directly change account details.

References:

Answer 2

Hello,

These days, hackers can bypass MFA/2FA by stealing your sign-in session token, often through phishing scams. For example, you might click on a malicious link and unknowingly expose your session token.

Another common scenario involves gamers who use Discord or gaming servers. They may be tricked into visiting fake websites designed to look like Microsoft's sign-in page, where they unknowingly enter their passwords and 2FA codes. Hackers can then use that information to gain access to their accounts, sometimes without needing to complete MFA again.

I am sharing an article here in case you want to learn about thist opic further. But bottom line is, it is possible, and to secure your account further, consider setting up passkey instead.
https://techcommunity.microsoft.com/blog/microsoft-entra-blog/how-to-break-the-token-theft-cyber-attack-chain/4062700

============

I am going to share a list of items you should go over to further review your account and secure as needed.

Please complete these steps on a computer, not on a smartphone or tablet.

Step 1: Sign out everywhere FIRST

Go to https://account.microsoft.com/security and sign in.

Go to Manage how I sign in, scroll down, and click Sign out everywhere.

This is intended to disconnect any active sessions that may still have access to your Microsoft account.

IMPORTANT: This process can take up to 24 hours to fully take effect. This means someone who is already signed into your account may not be disconnected immediately.

Continue the following after the 24-hour wait is over.

====================

Step 2: Review your Outlook settings

Go to https://www.outlook.com and sign in.

Click the gear icon in the top right corner to open Settings.

Under Mail, review the following areas:

Rules

If any rules are listed that you did not create, delete them. If you do not use rules at all, you can delete all of them.

Conditional formatting

If anything is set up there that you did not create, delete it.

Forwarding and IMAP

If you see any entries or settings you did not create, remove them. Turn off POP and IMAP if you do not use them.

Junk

Review your Safe senders and Blocked senders lists. Remove any unfamiliar entries from the Safe senders list.

After that, exit Settings and return to Outlook.com.

Open the To Do section by clicking the blue checkmark icon on the left side. Delete anything there that was not created by you.

====================

Step 3: Review your Microsoft account

Go to https://account.live.com.

Under Your info > Sign-in preferences, review all aliases on your account. If you see any alias you do not recognize, remove it. Be careful not to delete any legitimate email address you still use.

Next, go to the Devices section of your Microsoft account and remove any devices you do not recognize.

====================

Step 4: Secure your account

Go to the Security section of your Microsoft account.

Change your password to a new, strong password that you have never used before.

Enable two-step verification.

Go to Manage how I sign in and make sure all security contact information belongs to you.

On that same page, scroll down to App passwords and remove any existing app passwords you do not need.

====================

Step 5: Review app permissions

Go to https://account.microsoft.com/privacy/app-access.

Review the apps that have permission to access your Microsoft account.

Click Don't allow for anything you do not recognize or no longer use.