How to stop sending fake emails

This can be either spoofing or a compromised account.

• If those messages are not in Sent Items, the address may be getting spoofed. That means someone forged the From address, but did not necessarily sign in to the account.
• If there are unexpected messages in Sent Items, missing or deleted mail, rules that forward or move mail, or frequent password changes/lockouts, treat the account as compromised.

Do these steps now:

1. Check Sent Items Look for invitations or other messages that were not sent intentionally.
2. Check recent account activity Review recent sign-ins and unusual activity on the Microsoft account recent activity page. If sign-ins look normal and there are no sent messages, that points more to spoofing than a mailbox takeover.
3. Change the password immediately Use a strong, unique password.
4. Make sure multi-factor authentication is enabled MFA is one of the most important protections for accounts that use the email address for sign-in.
5. Check mailbox rules and forwarding Look for suspicious Inbox rules, especially rules that:
   • forward mail to unknown addresses
   • move messages to Junk Email, Notes, or RSS Subscriptions
6. Report suspicious messages as phishing or junk In Outlook, report the messages instead of interacting with them. Do not click links or open unexpected attachments.
7. Be cautious with related service emails If a message claims there was an order, invitation, or account action, do not use links or phone numbers in that message. Open a new browser tab and sign in from a saved favorite or by searching for the official site.
8. If contacts are receiving mail from the account or mail is being redirected Treat that as stronger evidence of compromise and continue securing the account by removing suspicious rules and reviewing account access carefully.

Useful signs of compromise include:

• mailbox blocked from sending
• suspicious or deleted email
• suspicious Inbox rules
• suspicious messages in Sent Items or Deleted Items
• unexplained account lockouts
• recently added external forwarding

• Respond to a compromised cloud email account
• Help protect your Outlook.com email account
• What to do if your email address is leaked
• How to spot a "fake order" scam
• Phishing and suspicious behavior in Outlook