If you think someone else is using your Microsoft account, first scan the device you use to sign in, then change your password or begin Microsoft’s recovery process. After you regain control, check for changes the intruder may have made, end other sessions, and restore trusted security methods. These steps apply to personal Microsoft accounts, including Outlook.com.
If you can still sign in, secure your device first
Microsoft’s recovery guidance says to make sure antivirus protection is current and run a full scan before changing the compromised account password. On Windows, open Windows Security → Virus & threat protection → Scan options → Full scan → Scan now. Microsoft’s instructions are at How to recover a hacked or compromised Microsoft account.
As an Amazon Associate I earn from qualifying purchases.
A full scan is a precaution, not proof that a device is clean. If you suspect another computer or phone may also be compromised, secure that device before using it to change credentials or access recovery codes. Microsoft also recommends keeping devices updated and configuring automatic updates and regular scans.
Recommended Free Tools
Change your password or start recovery
If sign-in still works
After scanning, change your password through your Microsoft account’s official security settings. Choose a new, unique password that you do not use on other sites. Avoid following password-reset links from unsolicited messages; navigate to Microsoft’s sign-in or account-security pages yourself.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If you’re locked out
Use Microsoft’s official password-reset flow or Sign-in Helper. You’ll need to prove that you own the account using a verification method Microsoft offers for it. If ordinary verification does not work, Microsoft’s account recovery form asks for information that can help verify ownership.
For the recovery form, provide a working email address where Microsoft can contact you. Microsoft recommends completing the form from a device and location you commonly use with the account, if possible. It says the result will be sent to the contact email within 24 hours. If a recovery attempt is unsuccessful, Microsoft says you can try again up to twice per day; its guidance is at Help with the Microsoft account recovery form and Account recovery unsuccessful.
If two-step verification is enabled and you cannot access any verification method, Microsoft says support agents cannot reset the account on your behalf. Don’t pay a third-party service that promises to bypass Microsoft’s verification or recover the account for you.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Check for changes and revoke other sessions
Review sign-in activity
Open the account’s Recent activity page and review sign-ins and security events. Report activity you don’t recognize through Microsoft’s account-security flow. An unfamiliar location or device is a reason to investigate, but Microsoft notes that location details can be approximate; judge an event using its other details as well. See What happens if there’s an unusual sign-in to your account.
Inspect Outlook and connected services
Look for connected accounts, mail forwarding rules, and automatic replies you did not set up. An intruder may leave these in place to keep receiving copies of mail or send messages from your address even after you change the password. Remove or correct unfamiliar settings. Microsoft specifically calls out these checks in its compromised-account recovery guidance.
Sign out elsewhere
If you suspect someone still has an active session, use Sign out everywhere in the account’s Advanced security options. Microsoft says the action can take up to 24 hours and does not sign the account out of Xbox consoles. A password change and a global sign-out are separate actions: do not assume that changing the password immediately ends every existing session. See How to sign out of your Microsoft account everywhere.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Restore security information you control
Review the recovery email addresses and phone numbers, Authenticator setup, passkeys, and security keys listed on the account. Remove methods you don’t recognize, and add methods you can access and control. Microsoft allows up to 10 security-info methods on an account; the choices available can vary. Its current overview is Microsoft account security info & verification codes.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Take care if you replace all security information at once. Microsoft says that when all security info is removed and replaced, the changes can remain pending for 30 days, with the account restricted during that period. If you did not request the change, use the let us know option on the account’s Security page rather than waiting silently. Details are in What does “Security info change is still pending” mean?
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choose stronger sign-in protection for the future
Once account access and recovery methods are under your control, enable two-step verification or choose an available passwordless sign-in method. Microsoft’s options include Microsoft Authenticator, passkeys, Windows Hello, physical security keys, and—in supported configurations—SMS codes. Not every option is available for every account. Microsoft describes passkeys as phishing-resistant; the options should not be treated as equally resistant to phishing. See How to help keep your Microsoft account secure and Microsoft account security info & verification codes.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A physical FIDO2-compatible security key is an optional way to sign in, not a recovery service or a requirement for regaining access. Check compatibility with your account and devices before relying on one, and keep another usable recovery method in case the key is lost. Microsoft’s overview of multifactor authentication explains why an additional factor helps: What is: Multifactor Authentication.
Save a recovery code before you need it
If the option is available in your account dashboard, generate a Microsoft account recovery code and store it somewhere safe offline, such as a printed copy kept away from devices you use to sign in. The code is 25 digits. Generating a new one invalidates the previous code, so replace old stored copies when you generate a replacement. Microsoft says not to keep the code on a device used to sign in. It can help when ordinary verification methods are unavailable, but it is a fallback to prepare in advance—not a way to bypass an account restriction already in effect. See How to get a Microsoft account recovery code.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
