How to tell if your account was compromised
The surest sign is a change you didn't make. Common signals, drawn from the FTC's consumer advice and Microsoft's own pages, include:
- A notification that your email address, phone number or password changed, when you didn't change it.
- A message saying someone tried to sign in, or did sign in, and it wasn't you.
- A password that suddenly stops working.
- Contacts telling you they received messages you never sent.
- Mail rules or forwarding you didn't create.
The FTC warns that compromised accounts like this are used for identity theft, spreading malware and scamming other people. That is why the mailbox needs cleaning up as well as the password changing.
Use the Recent activity page, and know its limits
Sign in at account.microsoft.com, open Security, then Recent activity. Microsoft says the page shows when and where you've used your account in the last 30 days (the page's own wording is from Microsoft Support). Expand any entry to see details such as:
- IP address
- Approximate location on a map
- Device or operating system
- Browser or app
Three limits matter:
- It isn't a complete log. Microsoft says it shows only significant events. If you sign in from the same device and place repeatedly, you may see only the first time. A clean-looking page doesn't prove nobody got in.
- It only covers 30 days. An older break-in won't appear.
- A strange location isn't proof. Microsoft notes mobile networks route traffic through other places, so a sign-in can appear to come from somewhere you weren't. Travel, a new device or an app signing in on your behalf can also trigger an alert. Check the device, OS and browser details alongside the location.
The page also splits entries into two sections:
- Recent activity. If you see only this section, nothing needs confirming. If something looks suspicious, such as repeated sign-in attempts or profile changes you didn't make, select Secure your account.
- Unusual activity. Expand an entry and choose This was me or This wasn't me. Choose "This wasn't me" if the activity wasn't yours or you're unsure. Microsoft will then ask you to change your password and update your security info.
Microsoft's activity descriptions are worth scanning for these entries in particular:
- Password changed
- Alternate email added or deleted
- Phone number added or deleted
- All security info marked for removal
- Two-step verification turned off
- Permission given to an application
- Sign-in blocked (Account compromised)
An "Incorrect password entered" entry means that attempt was refused. It might have been you, or it might have been someone guessing.
If you can still sign in
Microsoft's compromised-account guidance follows a specific order, and the order matters.
- Scan the PC first. Make sure your antivirus is running and up to date, then run a full scan before you change the password. In Windows Security, open Virus & threat protection, choose Scan options > Full scan > Scan now. If malware such as an infostealer copied your saved passwords or sessions, a new password typed on that PC could go to the same thief. Microsoft's page doesn't say that every takeover involves malware. The scan is a precaution.
- Change the password. Make it strong and don't reuse it. The FTC suggests aiming for 12 to 15 characters, or a passphrase of several words. That is FTC advice, not a Microsoft-specific rule.
- Check account settings. Microsoft says some settings were reset because someone else had access. Review connected accounts, forwarding and automatic replies.
- Sign out everywhere. Open the Additional security options on your security dashboard, scroll to Sign out everywhere and select Sign out. Microsoft says this can take up to 24 hours. It covers browsers, apps and other sign-ins, but not an Xbox console, which has its own sign-out process.
- Check recovery info and turn on two-step verification. Confirm the recovery email and phone number are yours. Remove any you don't recognize. Then turn on two-step verification or another strong method. The FTC says 2FA means a hacker with your password still can't get in without the second factor.
- Look for signs of access. The FTC recommends checking for auto-forwarding rules you didn't set up, since attackers use them to copy your mail elsewhere. Also warn contacts if messages went out from your account.
- Change reused passwords elsewhere. If other accounts use the same password, or send their reset emails to this address, treat them as at risk too.
If you're locked out
Start with Microsoft's Sign-in Helper. It asks for your email address or phone number, then points you to self-help or, where available, an agent. Microsoft says the recovery form takes time and recommends trying the helper first. Microsoft Q&A volunteers and moderators describe the same route, with a Microsoft MVP pointing people to the official article and its I think someone else is using my Microsoft account option.
If you reach the recovery form, these details from Microsoft's own guidance improve your odds:
- A working contact email. It can be any active address, even a friend's or relative's. Microsoft says it is used only to contact you about the request.
- As much account detail as you can supply. For Outlook.com or Hotmail.com accounts, expect questions about contacts and email subject lines. The subject lines must be exact. Skype contacts and purchases, an Xbox console hardware ID and old passwords can also come up. Check your browser or Windows credential storage for saved passwords. Microsoft says guessing is fine and wrong answers don't count against you.
- The right device and place. Complete the form from a device you've signed in on before, somewhere you normally use it, such as home or work.
- Patience with the result. Microsoft says it will send the outcome to your contact email within 24 hours. If it can't verify you, you can try again up to two times per day.
Check your spam folder for the reply. Don't pay anyone who promises to get the account back, because Microsoft's process is free.
Hard limits to understand
- Two-step verification can lock you out too. Microsoft says that if you turned it on and can't reach any alternate verification method, it cannot help. Keep more than one recovery method.
- Support agents can't do it for you. Microsoft states that agents and advocates aren't allowed to send password reset links or to access or change account details.
- Recovery isn't guaranteed. Microsoft Q&A moderators say that if the attacker replaced all security info and the form is repeatedly denied, there may be no other working route. That is community guidance, not a Microsoft policy statement. It does show why acting quickly and keeping recovery methods current matter.
After you're back in
- Report stolen personal data. In the US, the FTC says to report it at IdentityTheft.gov to get a personalized recovery plan. Elsewhere, use your national fraud service. Tell your bank about any charges you don't recognize.
- Reduce future exposure. Keep multiple recovery methods on the account. Use Microsoft Authenticator or another strong sign-in method.
- Watch for scam follow-ups. If you get an email about unusual activity and aren't sure it's from Microsoft, Microsoft says you can sign in to your account directly at any time without clicking the email's links.
The bottom line
The 2-Spyware guide that prompted this piece is broadly consistent with Microsoft's and the FTC's guidance. It presents itself as tested on Windows 11 26H2, but that is the publisher's claim. The page also carries promotional placements for a commercial scanner. You don't need one. Windows Security's built-in full scan, plus an offline scan if something turns up, is the step Microsoft actually documents.
The practical order is simple:
- Scan the PC.
- Change the password.
- Check forwarding and automatic replies.
- Sign out everywhere.
- Fix your recovery info.
- Turn on two-step verification.
- Fix every other account that shared the password.
If you're already locked out, start with the Sign-in Helper and the recovery form, and submit it from a familiar device and place.