Windows and Email Accounts - Respond to a Suspected Compromise

Summary

This article explains what to do if you think your Windows or email account has been compromised. Acting quickly can help protect your account, your data, and your organization's systems.

Before You Begin

• If possible, use a trusted device that you believe has not been compromised.
• Be prepared to verify your identity if you are prompted during the password reset process.

Steps

1. Determine whether your account may have been compromised. Common signs include:

   • You receive a password change confirmation that you did not initiate.
   • Your password suddenly stops working even though you are certain you entered it correctly.
   • You are prompted to approve a sign-in or multifactor authentication (MFA) request that you did not initiate.
   • Friends or coworkers report receiving unexpected or suspicious emails from your account.
   • You notice emails have been sent, deleted, or moved that you do not recognize.
   • Your account profile, recovery information, or security settings have changed without your knowledge.

2. Change your account password immediately using your organization's approved password reset process if you are still able to access your account.

3. If you cannot sign in because your password has changed unexpectedly or you no longer have access to your account, request assistance through your organization's approved support process immediately.

4. Review your recent account activity, if available, for unfamiliar sign-in locations, devices, or activity.

5. Verify that your account recovery information and multifactor authentication methods are still correct. Remove any phone numbers, email addresses, or authentication methods you do not recognize.

6. Notify your organization's IT or security team if you suspect your account has been accessed by someone else. Provide as much information as possible, including when you first noticed the issue and any unusual activity you observed.

7. Monitor your account after your password has been changed. Continue watching for unexpected password reset emails, unfamiliar sign-in prompts, or suspicious messages sent from your account.

Expected Outcome

Your account is secured with a new password, unauthorized access has been reported, and your organization can investigate any suspicious activity if necessary.

Additional Information

Not every unexpected sign-in issue means your account has been compromised. For example, you may have forgotten changing your password on another device or recently updated your password and are entering the previous one. However, if you are unsure whether the activity was legitimate, it is safest to treat the situation as a potential compromise and report it promptly.

Example Scenarios

• You receive an email stating your password was changed, but you did not make the change.
• Your usual password no longer works, and you do not remember changing it.
• You receive repeated multifactor authentication prompts that you did not request.
• Someone tells you they received unusual emails from your account.
• You notice emails have disappeared or been marked as read when you did not open them.
• You find unfamiliar rules, forwarding settings, or account information that you did not configure.

Need More Help?

If you still need assistance, use the Related Services / Offerings section on this page to request support.