Outlook Hacked? Deleted Emails, Hidden Rules and Card Charges You Didn't Make

It often starts with something small: your Outlook or Hotmail password suddenly doesn't work, or friends ask about an odd email you sent. When you get back in, your inbox is empty or half your emails are gone. New emails don't seem to arrive. And then a charge appears on your card that you didn't make, often for ChatGPT Plus or another online subscription.

These are all parts of the same attack. Someone got into your email, hid what they were doing with a rule, and used what they found, or a card saved in your account, to buy things. Here's how to deal with each part, in order.

Step 1: Get Back In and Lock Them Out

• If you can still sign in, change your password straight away to a new one you've never used anywhere else.
• If you can't, use Microsoft's password reset at account.live.com/password/reset. If the hacker changed your recovery phone and email, use Microsoft's account recovery form at account.live.com/acsr from a device and location you've used before, and give as much detail as you can.
• In your Microsoft account's security settings, check recent sign-in activity and remove any phone numbers, email addresses or devices you don't recognise.
• Turn on two-step verification using the Microsoft Authenticator app, or a passkey.

Step 2: Delete the Hacker's Rules and Forwarding

This is the step most people miss. Hackers often create an inbox rule so you don't notice what they're doing. Common ones:

• Delete every new email as it arrives
• Move emails containing words like "bank", "invoice", "password", "security" or "Microsoft" to an obscure folder such as RSS Feeds, Archive or Conversation History
• Forward a copy of everything to an outside address

To check in Outlook on the web (outlook.com) or the new Outlook app: go to Settings > Mail > Rules, and delete any rule you didn't create. Then check Settings > Mail > Forwarding and turn forwarding off unless you set it up. In classic Outlook on Windows, go to File > Manage Rules & Alerts.

While you're there, check your blocked senders and safe senders lists, your email signature, and the name shown on your emails.

Step 3: Recover Deleted Emails (Quickly)

Deleted emails aren't gone straight away, but the clock is ticking.

1. Look in the Deleted Items folder, and in any folder a rule moved emails into.
2. If Deleted Items has been emptied, open it and choose Recover items deleted from this folder. In Outlook.com, emails can usually be recovered for up to 30 days after they were removed from Deleted Items.
3. Select what you need and restore it.

For a work Microsoft 365 account, the recovery period is set by your organisation, usually 14 days by default, so ask your IT support straight away.

Step 4: Deal With the Card Charges

Charges for ChatGPT Plus, app stores, gaming or streaming subscriptions are some of the most common signs of a stolen card. Criminals use small monthly subscriptions to test a card, or to sell access on.

1. Call your bank on 159 or the number on your card. Tell them about every payment you don't recognise and ask them to cancel the card and send a new one. In most cases, banks must refund payments you didn't authorise.
2. Don't log in to the subscription to cancel it. It's usually on the criminal's own account, not yours. Your bank stops future payments when the card is cancelled.
3. Check where the card was saved: your Microsoft account under Payments & billing, your browser's saved cards, and any shopping accounts linked to that email. Remove any you don't need.
4. Search your emails for card numbers, scanned cards or bank details you've sent or received, and delete them.
5. Report it to Action Fraud, the UK's national fraud reporting service (in Scotland, call Police Scotland on 101).

Step 5: Check Everything Linked to That Email

Your email is the key to your other accounts. Anyone who controls it can reset passwords for shopping, banking apps, social media and more.

• Change the password of any account that used the same password, starting with banking, Amazon, PayPal and Apple or Google.
• Look for password reset emails you didn't request, in all folders and in Deleted Items.
• Check Sent Items for emails the hacker sent, and warn anyone who received a request for money or a link.
• Consider a password manager, so every account has a different password.

How Did It Happen?

Usually one of three things: a password used on another site that was breached, a convincing fake Microsoft login page in an email or text, or a call from someone claiming to be from Microsoft or your broadband provider. Two-step verification would have stopped most of these. See our guide on spotting scam calls, texts and emails.

How We Handle It

This is one of the most common jobs we're called out for. We work through it with you, remotely or at home across West London, including Kingston, Hampton, Richmond and Twickenham. We recover the account, remove the hacker's rules and forwarding, restore deleted emails while they're still recoverable, check your other accounts, help you through the call to your bank, and set up two-step verification and a password manager so it doesn't happen again. See our remote tech support, or book help today.

For a business Microsoft 365 account, see Microsoft 365 account hacked and sending spam.

Related Reading

• Email Account Hacked? What to Do Right Now
• Parcel Delivery Scam Texts
• WhatsApp Verification Code Scam