Using Classic Outlook on Windows for personal email, calendar, and contact management
Because the account was hacked, the attacker may have changed both mailbox settings and account security. The following steps help secure the account and then correct any changes:
- Make sure the device is clean
- Since a virus scan has already been run, ensure the antivirus is up to date and configured to scan automatically and get regular updates, as recommended.
- Secure the Microsoft account
- Go to the Security basics page.
- Select Change password and set a strong, unique password that is not used on any other site.
- Turn on two-step verification or add additional security info (alternate email and mobile phone) so the account is easier to recover and harder to compromise in the future. See the guidance under Add an alternate email address and mobile phone number to your account.
- Review recent sign-in activity
- On the same Security basics page, select Review activity.
- On the Recent activity page, check for sign-ins or security changes that are not recognized.
- For any activity in Unusual activity, expand it and choose This wasn’t me. For suspicious entries in Recent activity, expand and select Secure your account so Microsoft can help lock out the attacker.
- Recover from a hacked or compromised account
- Follow the steps in How to recover a hacked or compromised Microsoft account:
- Confirm the antivirus scan is complete.
- Change or reset the password if not already done.
- Check account settings that attackers often modify:
- Connected accounts
- Forwarding
- Automatic replies
- Remove any forwarding addresses, auto-replies, or connected accounts that are not recognized.
- Follow the steps in How to recover a hacked or compromised Microsoft account:
- Fix mailbox behavior and language-related changes
- Attackers sometimes change mailbox rules or settings that affect how mail and folders appear.
- In Outlook on the web, check:
- Settings → Mail → Rules and delete any rules that move, delete, or modify messages unexpectedly.
- Mail → Forwarding and remove any unknown forwarding addresses.
- After the account is secure, adjust Outlook’s language and regional settings back to English in Outlook or Outlook on the web if the display language was changed.
- If sign-in or recovery fails
- If sign-in becomes impossible or security info was replaced, use the account recovery flow described under When you can’t sign in to your Microsoft account and, if needed, select I think someone else is using my Microsoft account on the Forgot my password page to start the takeover-recovery process.
- Continue monitoring
- Periodically review the Recent activity page and mailbox rules/forwarding to ensure no new suspicious changes appear.
If at any point the account cannot be recovered with self-service steps, contact Microsoft Support via the official support channels and choose the options related to Manage account security.
References:
- How to recover a hacked or compromised Microsoft account
- Help protect your Outlook.com email account
- What happens if there's an unusual sign-in to your account
- My account got hacked. - Microsoft Q&A
- How do I send an email to Microsoft about my account being hacked and taken over by <removed> ? - Microsoft Q&A
- Hacker set up continuous draft ransomware email - Microsoft Q&A