Microsoft Account Hacked or Locked: What to Do, in the Right Order

Here's the catch. Microsoft says to run a full antivirus scan before you change the password, whichever antivirus app you use. And because someone else had access, Microsoft has already reset some of your account settings, so the job isn't finished when the new password works. You still need to check connected accounts, forwarding and automatic replies, because those are where an intruder can keep quietly reading or sending.

Hacked, locked or blocked: which one you've got

What you're seeing	What it means	First move, as of October 2026
Odd activity, or someone else has been in the account	Hacked or compromised	Malware scan, then a new password, then a settings check
A message saying the account has been locked	Activity on it might violate the Terms of Use	Sign in at account.microsoft.com, or use the sign-in helper
No Let's prove you're human option when you sign in	Locked for suspicious activity or a terms violation	The reinstatement link that starts with aka.ms/
Outlook.com temporarily blocked	Microsoft noticed unusual sign-in activity	The sign-in helper, then a security code or password change

One thing that looks like a block and isn't: if your Outlook.com mailbox or your OneDrive storage is full, you can't send or receive email. Check your mailbox storage before assuming the worst.

Step 1: clear malware off your PC

Make sure your antivirus is running and up to date. If you don't have one, Windows includes Microsoft Defender.

1. Open Windows Security.
2. Follow the on-screen instructions to open the Virus and threat protection tab.
3. Select Scan options, then Full scan, then Scan now.
4. Set your antivirus to update itself and scan on a regular schedule.

Step 2: change or reset the password

Once the scan's done, sign in and change your password. My guide to changing your Outlook password walks through it. If you can't sign in, reset the password instead. If none of your verification options work any more, the account recovery form is the last route back in.

Step 3: check what the intruder could have changed

• Connected accounts, in case another service has been linked to yours.
• Forwarding, in case your mail is being copied somewhere else.
• Automatic replies, in case someone set one up in your name.

When Microsoft has locked the account

Microsoft accounts are usually locked when the Microsoft Services Agreement has been broken. The common reasons are malware, phishing, spam, and using scripts or bots to create accounts. Spam includes unsolicited promotional content and messages sent to people you don't know, or to lots of people at once, which matters if someone else has been sending from your account.

1. Select the link in the window that begins with aka.ms/ and follow the instructions.
2. Submit the reinstatement form once.
3. Wait for a Microsoft Online Safety support agent to review it and email you.

Don't send extra requests, because Microsoft says that can slow the response down. Support agents can only send password reset links, or access and change account details, once you've submitted that reinstatement form.

Verification codes and sign-in methods

A verification code is how Microsoft knows it's you. It sends a code to the addresses or numbers on your account, and you type it back. To add a new method, go to account.microsoft.com/security, select Manage how I sign in, then Add a new way to sign in or verify. You can add up to 10 different methods:

Method	What to know, as of October 2026
An email address	It doesn't have to be yours, so a partner or family member's address works for emergencies
An authenticator app like Microsoft Authenticator	Lets you sign in even if the verification device is offline
A passkey	Uses your face, fingerprint or device PIN, and can't be guessed or stolen

The option to add a new phone number may not be available, because Microsoft is phasing out SMS for authentication and account recovery. Keep your list up to date, because if you change a work or school email address that you use for verification, you may lose access.

Locking the account down afterwards

1. Use the Microsoft Authenticator app, which adds a security layer and lets you sign in from your phone without a password.
2. Go passwordless: in Additional security options, under Passwordless account, select Turn on, then approve the request in Authenticator.
3. Add another way to sign in, so the account is easier to recover if it happens again.
4. On a public or shared computer, use a private window, sign out and close every browser window. If you've lost access to a device you were signed in on, sign out everywhere.
5. Keep your devices updated. Windows 10 support ended on October 14, 2025, so it no longer gets security fixes.
6. Never reply to an email asking for your password. Microsoft will never ask for it by email, even in a message that claims to be from Outlook.com.

Microsoft's view is that passwordless methods such as the Authenticator app, physical security keys and biometrics are more secure than passwords, which can be stolen, hacked or guessed. Once you remove your password, you sign in with Authenticator, Outlook for Android, Windows Hello, a security key or an SMS code.

My verdict on a hacked Microsoft account

I'd do it in Microsoft's order and not skip the scan, because a new password typed on an infected PC isn't much of a fix. Then I'd open forwarding before anything else, since that's the quiet one. And I'd go passwordless the same day. If you'd rather keep a password, make it a strong password and store it in a free password manager, so you're never reusing one across accounts.

Frequently asked questions

What should I do first if my Microsoft account is hacked?

Run a full antivirus scan on your PC, then change or reset your password, then check connected accounts, forwarding and automatic replies.

Why has Microsoft locked my account?

Accounts are usually locked when activity might violate the Microsoft Services Agreement, such as malware, phishing or spam.

How do I get a locked Microsoft account back?

Sign in at account.microsoft.com. If you can't, use the sign-in helper, or the reinstatement link that begins with aka.ms/.

Should I send more than one reinstatement request?

No. Microsoft says additional requests may slow down its response time.

Will Microsoft ever email me for my password?

No. Microsoft will never ask for your password in email, so never reply to one that does.