someone using my hotmail email address

Take these steps immediately to secure the Microsoft (Hotmail/Outlook.com) account and stop someone else from using it:

1. Review recent sign-ins and activity
   1. Go to the Security basics page and sign in.
   2. Select Review activity.
   3. On the Recent activity page, look for sign-ins or activity that are not recognized.
      • For entries in Unusual activity, expand them and select This wasn't me.
      • For entries in Recent activity, expand them and select Secure your account.
   4. Follow the prompts so Microsoft can help secure the account.
2. Change the password again from a clean device
   1. From the same Security basics page, select Change password.
   2. Set a strong, unique password that is not used on any other site.
   3. Do this from a device that is trusted and has been scanned for malware.
3. Add and verify extra sign-in methods
   1. On the Advanced security options page of the Microsoft account, select Add a new way to sign in or verify.
   2. Add at least one phone number and/or alternate email that is controlled and up to date.
   3. Make sure all listed phone numbers and email addresses for verification belong to the legitimate owner; remove any that do not.
4. Avoid staying signed in on shared or compromised devices
   1. When using a computer, phone, or tablet that might be shared or compromised, always use a private browsing window.
   2. After finishing, select the profile picture in the top-right corner of Outlook.com or other Microsoft web pages and choose Sign out.
   3. Close all browser windows after signing out.
   4. If there is no longer access to a device where the account was signed in, follow the guidance in How to sign out everywhere (linked from the security articles) to invalidate old sessions.
5. Turn on and harden two-step verification (MFA)
   1. Ensure two-step verification is enabled and working on the Microsoft account.
   2. Confirm that only trusted devices and authenticator apps are listed; remove any unknown devices.
   3. For persistent malicious rules or access, enabling MFA has been shown to stop recurring malicious actions.
6. If sign-in attempts or fraud continue
   1. If sign-in attempts keep appearing, change the password again and review all security info.
   2. Consider adding a new alias and making it the primary sign-in, then disabling sign-in with the old alias so it can no longer be used to log in while still receiving mail.
   3. For ongoing unusual sign-in alerts, continue to mark unknown activity as This wasn't me and follow the secure-account flow.

For the TikTok-specific activity (purchases and logins), also contact TikTok support directly to report fraud and have their account sessions revoked and payment details removed. Microsoft secures the email account and sign-in, while TikTok must act on the TikTok account and purchases.

References:

• How to help keep your Microsoft account secure
• How to sign in to Hotmail
• What happens if there's an unusual sign-in to your account
• Why can't I log in to my Outlook account? - Microsoft Q&A
• My personal hotmail account hacked by hacker with authentication app enabled. - Microsoft Q&A
• I have seen great advice for deleting the idtienphuoc1 Rule but none for stopping it from re-adding itself - Microsoft Q&A
• Lock or block login attempts - Microsoft Q&A
• Sign out of Hotmail or Outlook.com