mysle ze padlem ofiara phishingu

someone actually loged into my outlook account i just looked into "sent" messages from me and my mail was used to scam other people and someone is loging into it with i suppose vpn the only thing i want to know is how did they log in when i have 2fa and if im really in danger of this phishing or sextortion or whatever it is called. also thanks for quick response

Did you check your account's activities via https://account.live.com > Security? Do you see log in activities you don't recognize?

yes i saw like 40 from 2 days ago every single one was from usa, brazil, peru, argentina etc but i still dont know how did he log in while i had 2fa and why did he put an old password in the mail when i changed it one day before those log ins

In this case, you would have to move onto safe guarding your account. Please go through these places:

Make sure you do this on a computer, not on smartphone or tablet. Go to https://www.outlook.com and log in, click on the gear icon on the top right to launch the settings.

Then, on the Mail tab, go to Rules. Are there any rules set up here? If yes, delete them all.

Then check the conditional format, again, if it's there, delete it.

Then, check Forwarding and IMAP, If any items are present, delete them as well.

===========

Next, go to https://account.live.com > Your info > Sign in Preferences. Make sure to check all the aliases here. If you don't recognize any there, delete it.

Then go to Security > Manage How I sign in, make sure all contact info is yours.

Please make sure you change your password and verify two-step verficiation is enabled.

Go to your account online, go to Devices, remove any devices you don't recognize.

Then go to Security, click on Sign out everywhere. This is meant to kill any session that's still connected. Unfortunately, this one will take 24 hours to take effect.

Then, take one step further - Go to your Microsoft account online https://account.live.com> Sign in > Your info > Sign in preference. Add an alias - You have two options here:

Create new: this will allow you to use the native domain outlook.com to create a new alias.

Add existing: this will allow you to add a 3rd party email address, such as yahoo, gmail, as long as they are not already associated with another Microsoft account.

Once added, make this new alias your primary alias, do NOT delete the old alias. Then at the bottom, click on "Change sign in preference". On the next page, uncheck the box for the old alias. This means, from now one, the old alias cannot be used to sign into your Microsoft account, but it can be still used to receive emails, etc.

okay thanks for help really appreciate it but i have one last question am i in any danger from this guy with him realesing my persolan info etc because i had my home adress and debit card added to this account