Discover essential security features for your Outlook.com account.
If you are concerned that your email account has been hacked, it is important to login to your account as soon as possible. Once logged in, you can change your password to disrupt a cybercriminal's access and regain control over your email account.
If a cybercriminal has changed your password, skip to Step 1A o recover your email account.
By changing your password, all other sessions will be prompted for the new password which may take a few minutes.
After you have reset your password, skip to Step 2: Update your recovery details.
Recovery of your email account is only required if a cybercriminal has changed your password. If you have completed the previous step, you can skip this one.
You may be require to provide an alternative email address to which a recovery code/email will be sent to and to complete an audio or visual CAPTCHA.
Provide as much information as possible as this will help you recover your account.
It may take serveral days or weeks to receive an outcome as your request is reviewed.
In some cases, a cybercriminal may change the recovery details of your email account.
They can use this as a way to regain access to the email account even after you have changed your password. Be sure to check your account recovery details are linked to either a recovery email address or recovery mobile phone.
Note: if only one recovery mechanism is listed, and it is the one you want to delete, you will need to add a valid recovery mechanism first. To do this select Add Security info. This can either can be a mobile number or an alternative email address.
Cyber criminals may be logged into your email account after you have signed in.
By signing out of all sessions, you will disrupt a cybercriminal's access and regain control over your email account.
Note: that all account sessions on all browsers and devices will be signed out within 24 hours. Once completely signed out of all sessions and devices, sign back in again using your device to continue securing your Microsoft account.
Turning on multi-factor authentication is the most important defence against cybercriminals gaining access to your email account.
Muli-factor authentication makes it harder for cybercriminals to gain access to your email account by making them guess two piece of information rather than one (such as a password anda constantly changing PIN)
Cybercriminals will sometimes set up 'forwarding rules' to send themselves a copy of emails coming into or leaving your email account.
You should check your email account to see if cybercriminals have setup forwarding rules and delete any you don't recognise.
"POP and IMAP are protocols that allow emails to be accessed through other applications, such as Microsoft Outlook, Apple Mail and Mozilla Thunderbird. Cybercriminals sometimes use these as another method of accessing your email account, as it can allow them to bypass some security measures such as multi-factor authentication.
Check to see if any of your emails are being access by any suspicious external email clients or applications via POP. If you don't use an email application and only use an internet browser to access your emails, consider disabling POP as it can be used by cybercriminals to access your emails from another application.
IMAP should refer to a server relating to Outlook or Microsoft Office"
If forwarding is turned on to an account, you don't recognise then remove the address and turn it off by unticking the box.
Have you ever linked your Microsoft account to a third-party service? Many websites and applications can use this method to avoid having to create a new user account.
However, the connection this creates between your email account and the website / application is a common way for hackers to gain access to your email account.
Check if there are any apps or services that have access to your account and remove any that you don't recognise or no longer require.
Your login activity is a history of when and where someone has logged into your email account. Regularly review your login activity to check if your email account has been accessed at unusual locations.
If you see any suspicious activity since your last password change, select the drop-down arrow for that session and select Secure your account to change your password. Consider using a unique strong passphrase as your password.
Note: that if you do go ahead and Secure your Account, you will need to verify your identity and change your password. This will automatically log you out of all other existing sessions.
Once you have made sure cybercriminals don't have access to your email account, you may want to conider checking your email folders, specifically your Send, Draft and Bin Folders.
This will help you assess what actions a cybercriminal may have taken when they accessed your email account.
If someone has hacked into your email account, they may have tried to reset passwords for other online accounts that arelinked to that email address. These could be for banking and finance, social media or other accounts. Check for any password reset emails.
Search for emails that you did not send and take note of the recipient, whether attachments were includede, what the email was requesting and when it was sent.
Compare any unusual activity times with the time the email was sent. Check login activity everytime you become aware that a criminal contacted someone from your email account.
Have you ever saved your passwords usuing your web browser?
If you were signed into a Chrome web browser and save your username and password then those credentials can be accessed from your Google account.
If a cybercriminal has accessed your account, they may also have accessed your saved passwords. We recommend changing any saved account password that are store on you Google account.
If you used the same password for your email account and any other accounts, these may be no longer secure.
You should complete the following steps to help you keep your other accounts secure:
Password managers (which can also be used to store passphrases as well) enable a good cyber security habits.
Having unique passphrase for every valuable account may sound overwhelming; however using a password manager to save your passphrases will free you of the burden of remembering which passphrase goes where.
A lot of web browsers provide an in-built password manager. You might have noticed the pop-up window asking to store your password when logging into accounts. Password managers are also sold separatelu, however, quality and security may vary.
When using a password manager:
You may choose to keep track of your passphrases in a notebook rather than a password manager. No matter how you keep track of your passphrases, ensure you have a secure storage method.