What to Do If Your Microsoft 365 or Email Account Is Compromised
Two-step verification does not always stop account takeover. Here is how to lock out the attacker, clean up and protect a Microsoft 365 or email account.
Two-step verification used to be the answer to account takeover. It is still essential, but it no longer guarantees an account is safe. Microsoft describes attacks where a criminal takes over a session after the real person has entered their password and their code.
This guide explains how that happens, the signs to look for, and what to do in the first hour and afterwards. It is written mainly for a Microsoft 365 work account, and there is a short section for personal email at the end.
How an account is taken over even with two-step verification
The usual method is a fake sign-in page. It looks like Microsoft’s page, so the person types their password and their code. The fake page passes both to the real Microsoft sign-in, which signs in successfully, and the criminal keeps the signed-in session that comes back.
Microsoft says attackers can reuse a stolen session even when the person has completed two-step verification. In one campaign Microsoft documented, the attackers used the stolen session to add their own sign-in method to the account without being challenged, which can give them a way back in. That is why changing the password is not enough on its own.
Signs an account has been taken over
Microsoft lists the signs to look for. The mailbox may suddenly be blocked from sending email, or messages may go missing or be deleted. There may be rules in the inbox that forward mail to an address you do not know, or that quietly move messages into folders such as Notes, Junk Email or RSS Subscriptions so the real owner never sees the replies.
Look in the Sent Items and Deleted Items folders for messages the person did not write, such as an urgent request to send money. Other signs are a newly added forwarding address, a changed name or phone number in the address list, a signature that is not theirs, and repeated password changes or lockouts. A colleague or customer asking about an email the person never sent is another strong sign.
Step 1: Block the account and sign it out everywhere
Do this first, and do it quickly. If you are the person whose account it is, phone whoever manages your Microsoft 365 rather than emailing them, because the criminal may be reading the mailbox.
Your administrator should block the account from signing in, then sign it out of every device and session. Microsoft recommends blocking access as soon as possible, and signing out everywhere matters because a stolen session can keep working for a while, even after the password changes. Once that is done, reset the password to a new, strong one.
Step 2: Check the sign-in methods
Look at the phone numbers and authenticator apps registered to the account. Remove any you do not recognise, because attackers can add their own. Then have the real person set up their sign-in methods again.
Step 3: Look for hidden rules and forwarding
Check the mailbox for rules and forwarding that the person did not create. Take a screenshot of each one before you delete it, because they show what the criminal was doing and they may help later. Then remove them.
Check the Sent Items folder for messages the person did not send, and note who received them.
Step 4: Warn people and protect your money
Tell the people who may have received messages from the account, especially customers and suppliers. Criminals often use a stolen mailbox to ask for payment or to say that bank details have changed.
Check any recent payment requests, and confirm any change of bank details by phone, using a number you already have rather than one in the email. If money has been sent, call your bank immediately and ask them to try to stop or recall the payment.
If the account held personal information about customers or staff, there may be legal duties to report the breach, so get advice quickly.
Step 5: Check what else the account could reach
Microsoft notes that an attacker with access to the account can reach the mailbox, shared files in SharePoint and files in OneDrive. Look for files that were opened, shared or deleted that the person did not touch. Check for apps that the account has been allowed to connect to, and remove any you do not recognise.
Change the password on any other account that used the same password, and check the person’s Mac or iPhone for anything unusual. If they entered their details on a fake page, assume the password and the session are both compromised.
Step 6: Make it harder next time
The strongest protection is a sign-in method that cannot be handed to a fake page. Passkeys and security keys work this way, because they only respond to the real Microsoft sign-in. A code from a text message or an app can be typed into a fake page, so it is better to use those only as a back-up.
Keep at least two administrator accounts, and never use an administrator account for everyday email. Some protections against stolen sessions need particular Microsoft 365 plans, which we can check for you. Our guide to setting up Microsoft 365 for a Mac-based business covers the basics, and our guide to spotting phishing scams helps your team recognise the lures.
If it is a personal email account
Use your email provider’s account recovery to get back in, change the password, and sign out of all other devices. Check for forwarding addresses and filters you did not create, turn on two-step verification again, and consider a passkey. Tell your contacts, and change the password on any other account that shared it.
Need a hand?
If you think an account has been compromised right now, call us on 1800 738 031. We can help you lock the account down, clean it up and put better protection in place. See our Security & Email Protection service, our Microsoft 365 & Email service, or our Online Safety & Protection service for home users, or contact Your Mac Tech.
