Account Compromised

Question

Account Compromised

ali e 20

Hi,

I just found out that my account has been compromised, for God knows how long. I was able to change my password on both my Outlook and Gmail and lock all my banking cards.

I never had any payments methods saved on my account until a week or two ago when I decided to pay for Copilot... Today the hacker tried to make a purchase from a website I have an account with that sends you your user and password when requesting a reset so I assume they were trying to use the banking details I recently added to make a purchase. I was able to lock my cards and going to be requesting new ones.

I then combed everything in activity history to see how this happened and since how long but I think they may have been able to delete their activity so everything looks normal.

How can Microsoft further help ensure I'm safe? What can I do next?

Thanks in advance

0 comments

Answer accepted by question author

Jeronimo Fuerte 48,705 Independent Advisor

You've already taken several important steps by changing your passwords and contacting your bank. However, changing your password alone may not immediately terminate every existing session. I recommend visiting https://account.live.com/proofs/manage/additional, and selecting Sign out everywhere. This may take up to 24 hours.

While you're there, review your security information for unfamiliar recovery email addresses, phone numbers, or authentication methods, remove anything you don't recognize, and enable two-step verification if it isn't already active. Also, check Outlook.com > Settings > Mail > Rules and Forwarding and IMAP for any unauthorized rules or forwarding addresses, as these could allow someone to continue receiving your emails. Since you've already reviewed your sign-in history, keep in mind that Microsoft's Recent activity page only covers the last 30 days and doesn't necessarily display every account activity.

Review your Microsoft purchase history and continue working with your bank regarding suspicious transactions.

https://account.live.com/billing/orders

ali e 20 Reputation points

2026-11-10T02:52:16.97+00:00

Thanks Jeronimo for the quick response.

I have done a forced sign-out since I wrote this post. However there was another attempt to make a purchase from the hackers minutes ago after doing the above and I'm no longer sure if my account is secured... Please help.

Also I have deeper concerns since I don't know how long they have had access - Can I see if they've downloaded any of my email or attachments/ exported as .pst? How can I access a longer sign in history or activity that may have been deleted by the hackers?
Jeronimo Fuerte 48,705 Reputation points Independent Advisor

2026-11-10T03:09:07.5333333+00:00

Sign out everywhere can take up to 24 hours to complete. Also, if someone already obtained your payment details or credentials for the shopping website, they could continue attempting purchases without accessing your Outlook account again. I recommend contacting that website directly, changing its password, and asking its support team to terminate all active sessions and investigate the unauthorized purchase attempts. Since you've already changed your Microsoft password and requested replacement bank cards, please also ensure that two-step verification is enabled, review your account's recovery methods, and run a full malware scan on your computer. If the scan detects anything suspicious, change your passwords again from a trusted device.

Regarding your other questions, Microsoft's Recent activity page only displays the last 30 days and does not include every account activity. Unfortunately, personal Outlook.com accounts do not provide a user-accessible mailbox audit log that would allow you to determine exactly which emails or attachments someone viewed, downloaded, or exported to a PST file.

Please understand that support is not able to confirm whether your emails were downloaded or provide historical logs beyond those available to you. One question: Was the latest attempted purchase made through your Microsoft account, or through the separate shopping website you mentioned?
ali e 20 Reputation points

2026-11-10T03:26:07.5866667+00:00

Thanks again. Ran a full scan with Windows Defender and no issues. Setting up 2FA right now and confirming recovery options.

That last part really hurts, because in my mind is spilling over into identity theft category, even though no tangible harm has ocurred. This may not be the forum but how can I approach this from that standpoint? What pre-emptive action can I take here should they have had access to emails and content.

For your question, that last attempted purchase was through the separate shopping website. Since then, my account there has been blocked (by the merchant) and now I have no other way to tell whether there are still attempts being made or if they still have access to my e-mail.
Jeronimo Fuerte 48,705 Reputation points Independent Advisor

2026-11-10T03:37:39.48+00:00

Since you confirmed that the latest purchase attempt occurred through a separate shopping website, that activity does not necessarily indicate that someone still has access to your Microsoft account.

From an identity theft prevention standpoint, I recommend reviewing what sensitive information may have been stored in your mailbox, particularly identification documents, banking information, account statements, or messages containing credentials and password-reset links. Secure any affected accounts individually, monitor your financial accounts for unfamiliar activity, and preserve evidence of suspicious transactions or notifications. Depending on your country, you may also be able to request a fraud alert or credit freeze through your local credit reporting agencies to help prevent unauthorized accounts from being opened in your name.
ali e 20 Reputation points

2026-11-10T04:07:56.4466667+00:00

Appreciate the close support, sincerely. It's tough going through this alone.

I think I done about as much as I could securing the account. Did the same thing on my Gmail just in case.

It's gonna take a while to stop tripping over what the hackers may have accessed/ downloaded sensitive info as it seems that's something we cannot tell. I also no longer feel comfortable continuing with the same e-mail address - is there a way to migrate information and emails efficiently over to a new address?
Jeronimo Fuerte 48,705 Reputation points Independent Advisor

2026-11-10T04:15:15.2933333+00:00

Microsoft provides a way to change it without having to migrate your emails or other information. You can create a new Outlook.com email alias within your existing Microsoft account by visiting https://account.live.com/names/manage, selecting Add email, and creating a new Outlook.com address. Once added, you can select Make primary next to the new address. Your existing emails, contacts, OneDrive files, and Microsoft subscriptions, including Copilot, will remain associated with the same account. For additional security, you can visit Sign-in preferences and disable sign-in using your old email address while keeping it available to receive messages. I recommend keeping the old address during the transition so you can update the email associated with your other services. Please don't remove the old alias, as removing a Microsoft-domain email address permanently deletes that address and it cannot be recovered.
ali e 20 Reputation points

2026-11-10T04:45:51.81+00:00

Thank you for the additional tips. I was considering closing this Microsoft account altogether and starting a new one from scratch, while following some of your instructions like keeping the current one active until transition is complete. However as you're advising not to delete the affected MS-domain, I'm afraid simply changing alias email associated with the MS account does not actually make me untraceable again to these hackers. Though I've seriously cleaned up and re-secured everything, I can't help but keep thinking these losers may still be one-upping me and somehow are still able to access the account.

I'm assuming a sync between two separate MS accounts is not as straightforward or even possible (without multiple manual steps like exporting items) like syncing between two aliases under the same MS account...

1 additional answer

Your answer

ali e 20 Reputation points

2026-11-10T02:52:16.97+00:00

Thanks Jeronimo for the quick response.

I have done a forced sign-out since I wrote this post. However there was another attempt to make a purchase from the hackers minutes ago after doing the above and I'm no longer sure if my account is secured... Please help.

Also I have deeper concerns since I don't know how long they have had access - Can I see if they've downloaded any of my email or attachments/ exported as .pst? How can I access a longer sign in history or activity that may have been deleted by the hackers?
Jeronimo Fuerte 48,705 Reputation points Independent Advisor

2026-11-10T03:09:07.5333333+00:00

Sign out everywhere can take up to 24 hours to complete. Also, if someone already obtained your payment details or credentials for the shopping website, they could continue attempting purchases without accessing your Outlook account again. I recommend contacting that website directly, changing its password, and asking its support team to terminate all active sessions and investigate the unauthorized purchase attempts. Since you've already changed your Microsoft password and requested replacement bank cards, please also ensure that two-step verification is enabled, review your account's recovery methods, and run a full malware scan on your computer. If the scan detects anything suspicious, change your passwords again from a trusted device.

Regarding your other questions, Microsoft's Recent activity page only displays the last 30 days and does not include every account activity. Unfortunately, personal Outlook.com accounts do not provide a user-accessible mailbox audit log that would allow you to determine exactly which emails or attachments someone viewed, downloaded, or exported to a PST file.

Please understand that support is not able to confirm whether your emails were downloaded or provide historical logs beyond those available to you. One question: Was the latest attempted purchase made through your Microsoft account, or through the separate shopping website you mentioned?
ali e 20 Reputation points

2026-11-10T03:26:07.5866667+00:00

Thanks again. Ran a full scan with Windows Defender and no issues. Setting up 2FA right now and confirming recovery options.

That last part really hurts, because in my mind is spilling over into identity theft category, even though no tangible harm has ocurred. This may not be the forum but how can I approach this from that standpoint? What pre-emptive action can I take here should they have had access to emails and content.

For your question, that last attempted purchase was through the separate shopping website. Since then, my account there has been blocked (by the merchant) and now I have no other way to tell whether there are still attempts being made or if they still have access to my e-mail.
Jeronimo Fuerte 48,705 Reputation points Independent Advisor

2026-11-10T03:37:39.48+00:00

Since you confirmed that the latest purchase attempt occurred through a separate shopping website, that activity does not necessarily indicate that someone still has access to your Microsoft account.

From an identity theft prevention standpoint, I recommend reviewing what sensitive information may have been stored in your mailbox, particularly identification documents, banking information, account statements, or messages containing credentials and password-reset links. Secure any affected accounts individually, monitor your financial accounts for unfamiliar activity, and preserve evidence of suspicious transactions or notifications. Depending on your country, you may also be able to request a fraud alert or credit freeze through your local credit reporting agencies to help prevent unauthorized accounts from being opened in your name.
ali e 20 Reputation points

2026-11-10T04:07:56.4466667+00:00

Appreciate the close support, sincerely. It's tough going through this alone.

I think I done about as much as I could securing the account. Did the same thing on my Gmail just in case.

It's gonna take a while to stop tripping over what the hackers may have accessed/ downloaded sensitive info as it seems that's something we cannot tell. I also no longer feel comfortable continuing with the same e-mail address - is there a way to migrate information and emails efficiently over to a new address?
Jeronimo Fuerte 48,705 Reputation points Independent Advisor

2026-11-10T04:15:15.2933333+00:00

Microsoft provides a way to change it without having to migrate your emails or other information. You can create a new Outlook.com email alias within your existing Microsoft account by visiting https://account.live.com/names/manage, selecting Add email, and creating a new Outlook.com address. Once added, you can select Make primary next to the new address. Your existing emails, contacts, OneDrive files, and Microsoft subscriptions, including Copilot, will remain associated with the same account. For additional security, you can visit Sign-in preferences and disable sign-in using your old email address while keeping it available to receive messages. I recommend keeping the old address during the transition so you can update the email associated with your other services. Please don't remove the old alias, as removing a Microsoft-domain email address permanently deletes that address and it cannot be recovered.
ali e 20 Reputation points

2026-11-10T04:45:51.81+00:00

Thank you for the additional tips. I was considering closing this Microsoft account altogether and starting a new one from scratch, while following some of your instructions like keeping the current one active until transition is complete. However as you're advising not to delete the affected MS-domain, I'm afraid simply changing alias email associated with the MS account does not actually make me untraceable again to these hackers. Though I've seriously cleaned up and re-secured everything, I can't help but keep thinking these losers may still be one-upping me and somehow are still able to access the account.

I'm assuming a sync between two separate MS accounts is not as straightforward or even possible (without multiple manual steps like exporting items) like syncing between two aliases under the same MS account...

Answer 1

Do these next, in this order:

Scan the PC for malware before changing anything else again
- Open Virus and threat protection.
- Select Scan options > Full scan > Scan now.
- Make sure antivirus protection is up to date. This matters because Microsoft recommends clearing malware before changing passwords.
Review Microsoft account sign-in activity
- Go to the Security basics page.
- Select Review activity and inspect the Recent activity page.
- If an item appears under Unusual activity, expand it and select This wasn't me.
- If suspicious activity appears in Recent activity, expand it and select Secure your account. The Recent activity page shows sign-ins from the last 30 days, with device or app details.
Change the Microsoft account password again if compromise is still suspected
- From Security basics, select Change password.
- Use a strong, unique password.
- If sign-in stops working, use Forgot my password and choose I think someone else is using my Microsoft account during recovery.
Check Outlook.com settings that attackers commonly change
- Review connected accounts.
- Review forwarding.
- Review automatic replies. Microsoft notes that some account settings may be reset after compromise, and these are key places to verify.
Update security information
- On Security basics, add or update security info.
- Remove any sign-in method, email, or phone information that is not recognized.
Remove trusted access and sign-ins on other devices
- On the security settings page, remove all trusted devices. This helps cut off existing trusted sessions.
Turn on stronger protection
- Enable two-step verification.
- Consider passwordless sign-in with Microsoft Authenticator.
Use Microsoft support channels if needed
- If the sign-in helper cannot resolve the issue, use Contact Support from Microsoft Support.
- Microsoft support agents cannot send password reset links or directly change account details.

Important points based on the symptoms described:

The Recent activity page only shows the last 30 days, so older attacker activity would not appear there.
If a purchase attempt happened after card details were added elsewhere, replacing the cards was the correct step.
If Outlook.com was involved, checking forwarding and connected accounts is especially important because attackers often use those to keep access or intercept mail.

References: