How to Recover a Hacked Outlook Account in 2026
If your Outlook account has been taken over, acting quickly can help you regain access before the attacker changes recovery details or uses your email to reset other accounts.
This guide explains how to recover a hacked Outlook account, secure your Microsoft account, and reduce the risk of being locked out again.
Signs Your Outlook Account May Be Compromised
Before you start recovery, confirm that the problem is truly unauthorized access.
Hackers often try to hide by changing settings quietly.
- Unexpected password reset emails or security alerts from Microsoft
- Sent messages in your Outlook mailbox that you did not send
- Changed recovery email address or phone number
- New inbox rules that move, delete, or forward mail
- Sign-in attempts from unfamiliar locations or devices
- Missing contacts, deleted folders, or changed profile information
If you notice more than one of these symptoms, treat the account as compromised immediately.
First Steps to Recover a Hacked Outlook Account
Start with the official Microsoft recovery flow.
Do not trust third-party tools, “account repair” services, or messages claiming they can restore access faster.
Reset your password
If you still have access to the account recovery phone number or email, go to the Microsoft sign-in page and choose the password reset option.
Create a new password that is long, unique, and not used anywhere else.
Use the Microsoft account recovery form
If the hacker changed the password and recovery options, use the Microsoft account recovery form to verify ownership.
Provide accurate details such as previous passwords, subject lines from recent emails, and billing information tied to the account if applicable.
Check whether your identity must be verified
For accounts protected by multi-factor authentication, Microsoft may require a code sent to your phone, email, or authenticator app.
If the attacker altered those methods, the recovery form becomes especially important.
Secure the Account After You Get Back In
Getting access back is only the first step.
You must remove unauthorized changes so the attacker cannot return.
Review sign-in activity
Open your Microsoft account security page and inspect recent sign-ins.
Look for unfamiliar devices, IP locations, or repeated failed attempts.
If you see activity you do not recognize, sign out of all sessions and change your password again.
Remove unknown recovery options
Hackers often replace the backup email address or phone number with their own.
Delete any recovery details you did not add yourself and confirm that your current ones are correct.
Enable multi-factor authentication
Turn on multi-factor authentication through Microsoft Authenticator, a trusted phone number, or another approved method.
MFA adds a critical layer of protection even if your password is stolen again.
Check mailbox rules and forwarding settings
Attackers commonly create rules that forward copies of your mail to another address or move security alerts into hidden folders.
Review these settings carefully in Outlook and remove anything suspicious.
Scan connected devices for malware
If the attack started on a compromised computer or phone, malware may still be harvesting credentials.
Run a full security scan with Microsoft Defender or another reputable antivirus tool, update your operating system, and remove unknown browser extensions.
What If You Cannot Access the Recovery Email or Phone?
Many people searching for how to recover hacked Outlook account have lost access to the recovery methods as well.
If that happens, focus on the Microsoft account recovery form and provide the strongest proof possible.
- Approximate account creation date
- Recent subject lines from emails you sent or received
- Commonly used folders, contacts, or aliases
- Skype name, Xbox profile, or Microsoft 365 subscription details if linked
- Billing information or purchase history associated with the account
Use a secure device and a familiar network when completing the form.
Microsoft may reject submissions that appear inconsistent, so accuracy matters more than speed.
How to Protect Other Accounts Linked to Outlook
A hacked Outlook account can become a gateway to other services because email is often used for password resets.
Secure your most important accounts as soon as possible.
- Change passwords for banking, social media, shopping, and work accounts
- Enable MFA on every important account
- Review account recovery email addresses on other services
- Watch for fraudulent password reset messages
- Alert your employer or IT team if the Outlook address is tied to business systems
If you reused the same password on other websites, treat those accounts as exposed and replace each one with a unique password.
Common Mistakes to Avoid During Recovery
Poor recovery habits can make a bad situation worse.
Avoid these mistakes while trying to regain access.
- Do not respond to phishing emails pretending to be Microsoft support
- Do not pay strangers who promise guaranteed recovery
- Do not reuse the old password or a small variation of it
- Do not ignore mailbox rules, delegates, or forwarding settings
- Do not delay reporting suspicious transactions if your account was used to access financial services
Also avoid repeatedly submitting incorrect recovery forms too quickly.
Take time to gather the right details before retrying.
When to Contact Microsoft Support or Your Organization
If recovery attempts fail, contact Microsoft support through official channels and explain that the account was compromised.
Have as much information ready as possible, including the affected email address, approximate date of compromise, and any error messages you received.
If the Outlook account belongs to a work or school Microsoft 365 tenant, contact your organization’s IT administrator immediately.
Administrators can often disable sessions, reset credentials, and check for suspicious mailbox activity faster than consumer support.
How to Prevent Another Outlook Account Hack
After you restore access, strengthen the account so the same attack path does not work again.
Consistent security habits matter more than one-time fixes.
- Use a password manager to generate unique passwords
- Keep Microsoft Authenticator or another MFA app updated
- Watch for phishing links in emails and text messages
- Review security alerts from Microsoft regularly
- Update recovery information whenever your phone number changes
- Keep Windows, macOS, iOS, and Android devices patched
For higher-risk users, such as business owners or people handling sensitive data, consider adding a hardware security key that supports modern authentication standards.
Key Microsoft Security Features Worth Using
Microsoft offers several tools that can improve account protection when configured correctly.
These are especially useful after a compromise:
- Microsoft Authenticator for push-based approval and number matching
- Passwordless sign-in to reduce dependence on passwords
- Security alerts for unfamiliar sign-ins
- Recovery codes stored safely offline
- App passwords only when required for older apps
Using these features together creates multiple barriers that make takeover attempts harder to succeed.
When to Treat the Incident as Identity Theft
If the hacked Outlook account exposed personal data, financial details, or government documents, the problem may extend beyond email access.
Monitor bank and credit card statements, change passwords for financial accounts, and consider placing fraud alerts where appropriate.
You should also check whether the attacker sent scam messages to your contacts from your address.
Warn friends, colleagues, and family not to open links or share credentials in response to suspicious messages that appear to come from you.
Recovering Faster Next Time
The best time to prepare for account recovery is before anything goes wrong.
Keep your recovery email current, save backup codes offline, and make sure your phone number and authenticator app are backed up safely.
If you ever need to learn how to recover a hacked Outlook account again, having these safeguards in place can cut recovery time dramatically.