Repeated Unauthorised Login Attempts

Question

Repeated Unauthorised Login Attempts

Arfa Tayyabah 0

Hello,

For the past two weeks, my School email account is targeted by several unauthorised login attempts. I'm receiving verification codes via text several times a day.

When I checked recent activity page, I saw a massive list of login attempts made from IP addresses all over the world.

The situation is so severe that even now I can't receive code and sign into my account.

Please, help me stop these attempts and fix the issue.

Thank you for the help.

HappyDays 0 Reputation points

2026-07-14T04:06:01.29+00:00

If it’s a school email account, speak to your school admin or IT person, explain the issue you have experienced and ask if they can provide you a new email address. They can then remove the old email that has been compromised. They will probably be able to redirect mail to your new email too.

It can seem like bullying and feel very scary when you get multiple login attempts. This happened to me for about a year, with 30 attempts per day. I changed my settings to have two factor authentication and I also went passwordless. I then created a new email and moved all my emails to a new account. Eventually, the login attempts stopped.

Attempts from multiple countries are usually just hidden IP addresses and not necessarily from different countries. They are also automated by a computer and not a personal attack on you.

I hope you get it resolved easily.

Answer recommended by moderator

EmilyS_726 29,665 Volunteer Moderator

Because this is a school-managed account, you need to contact your school’s IT department or Microsoft 365 administrator immediately. They have admin tools to review and strengthen security, or if necessary, give you a different alias.

0 comments

1 additional answer

Your answer

HappyDays 0 Reputation points

2026-07-14T04:06:01.29+00:00

If it’s a school email account, speak to your school admin or IT person, explain the issue you have experienced and ask if they can provide you a new email address. They can then remove the old email that has been compromised. They will probably be able to redirect mail to your new email too.

It can seem like bullying and feel very scary when you get multiple login attempts. This happened to me for about a year, with 30 attempts per day. I changed my settings to have two factor authentication and I also went passwordless. I then created a new email and moved all my emails to a new account. Eventually, the login attempts stopped.

Attempts from multiple countries are usually just hidden IP addresses and not necessarily from different countries. They are also automated by a computer and not a personal attack on you.

I hope you get it resolved easily.

Answer 1

The account is under attack by repeated sign-in attempts, but as long as the verification codes are not approved or used, the account remains protected. To reduce and stop these attempts and regain access, follow these steps.

Stop responding to unrequested codes
- Do not enter or approve any verification code that was not requested personally.
- Unrequested codes usually mean someone is trying to sign in with the account or accidentally typed the address. Without the code, they cannot get in.
- See: Troubleshoot unrequested verification codes for why this happens and why ignoring them keeps the account safe.
Wait out temporary blocks and avoid repeated attempts
- Microsoft may temporarily block sending verification codes or sign-in attempts when there is unusual or high-volume activity, including many MFA prompts or code requests.
- Do not keep retrying sign-in or requesting more codes; this can extend the block.
- Guidance from the two-step verification article: if blocked, wait at least 24 hours (and up to a week in severe cases) without further attempts so the lockout can expire before trying again.
Use a different verification method if possible
- If the current method (SMS) is blocked or unreliable, try another method already configured on the account (for example, Authenticator app, alternate email, or security key) when the sign-in screen offers Try another verification method.
- If the block is tied to one method, switching to another method can allow sign-in.
Check recent sign-in activity and secure the account
Once access is possible again:
1. Go to the My Account portal and open Recent Activity to review sign-in attempts.
2. If any successful sign-in or activity is not recognized, immediately change the password and then go to Security info to review and update MFA methods.
3. For a personal Microsoft account, the Security basics and Recent activity pages can also be used to review and secure the account.
Consider going passwordless / strengthening sign-in
- To reduce reliance on codes that can be spammed, move toward passwordless sign-in methods such as Microsoft Authenticator, Windows Hello, or security keys, as described in How to go passwordless with your Microsoft account.
- Passwordless methods are more resistant to these types of attacks and reduce the impact of repeated username/password attempts.
Work or school account: involve the school IT/administrator
- Because this is a school account, contact the school’s IT help desk or Microsoft Entra administrator:
  - Ask them to review Microsoft Entra sign-in logs for the account to confirm the attack pattern.
  - Request that they clear MFA settings if needed so registration can be redone on a clean device.
  - They can also apply additional protections such as conditional access policies (e.g., blocking risky locations or devices) and risk-based MFA policies.
If codes are not arriving at all
- Heavy compromised traffic or risk-based blocking can delay or stop SMS codes temporarily. This usually resolves automatically after some time.
- Ensure the phone is able to receive SMS from unknown numbers and that the inbox is not full.
- If still blocked after waiting the recommended period, the school IT admin must assist, as support agents cannot override verification or send codes on behalf of users.

Following these steps, plus administrator review of sign-in logs and MFA configuration, will stop or greatly reduce the unauthorized attempts and restore reliable access.

References: