Has anyone had message forwarding turn itself on to an unknown email address after credential change?

Question

Has anyone had message forwarding turn itself on to an unknown email address after credential change?

john Viveiros 5

My hotmail account was hacked. I caught it quickly & changed credentials.

Hacker created rules & setup forwarding to an unknown email address which I fixed & turned off forwarding. 2 days later, forwarding is turned back on to what I think is the same unknown email address.

I see no successful logins to my microsoft account since the credential change. Have virus and malware scanned the system several times and can't figure out how forwarding turned itself back on. Any ideas?

rao abdullah 0 Reputation points

2025-11-01T21:58:08.5466667+00:00
Hi John, sounds like a lingering session or linked app may still have access. Try this:

Go to account.live.com/Activity → Sign out everywhere.

Remove unknown devices or apps under Security → Advanced security options.

In Outlook Web, delete all inbox and sweep rules, then check Forwarding again.

Turn on 2-step verification to block reactivation.

Run a Windows Defender Offline scan to rule out hidden malware.

If forwarding reappears, contact Microsoft support with the suspicious address—they can trace the linked app or session.

This combo usually stops the auto-forwarding issue for good.
john Viveiros 5 Reputation points

2025-11-02T23:28:20.0433333+00:00

Thanks Rao-

I should have mentioned I originally did a "sign out everywhere" as part of my original effort. I'm not sure why this take 24 hours but that's what it says on the page. I did turn on 2 step verification at that time.

also - I did clear all devices... I don't remember if I cleared all apps or xbox (which I don't have) but have since. I'm checking hourly to see if it comes back and hasn't since ....so fingers crossed. This has me spooked.

Your answer

rao abdullah 0 Reputation points

2025-11-01T21:58:08.5466667+00:00

Hi John, sounds like a lingering session or linked app may still have access. Try this:

Go to account.live.com/Activity → Sign out everywhere.

Remove unknown devices or apps under Security → Advanced security options.

In Outlook Web, delete all inbox and sweep rules, then check Forwarding again.

Turn on 2-step verification to block reactivation.

Run a Windows Defender Offline scan to rule out hidden malware.

If forwarding reappears, contact Microsoft support with the suspicious address—they can trace the linked app or session.

This combo usually stops the auto-forwarding issue for good.
john Viveiros 5 Reputation points

2025-11-02T23:28:20.0433333+00:00

Thanks Rao-

I should have mentioned I originally did a "sign out everywhere" as part of my original effort. I'm not sure why this take 24 hours but that's what it says on the page. I did turn on 2 step verification at that time.

also - I did clear all devices... I don't remember if I cleared all apps or xbox (which I don't have) but have since. I'm checking hourly to see if it comes back and hasn't since ....so fingers crossed. This has me spooked.