Think your account has been hacked? Do this now
Updated 10 November 2026 · Security
The warning signs that someone else is using your email or Microsoft 365 account, and the first steps to take while we lock it down.
When an attacker gets into a work email account, they rarely announce it. They read quietly, look for invoices and payment conversations, and then use your account to send convincing messages to your customers and suppliers. The faster we know, the less damage they can do, so if anything on this page sounds familiar, contact us straight away. You will not be in trouble for raising a false alarm.
Warning signs
Colleagues or customers reply to emails you never sent, or ask whether a message from you is genuine. You find sent messages you do not recognize, or replies that went missing because a rule moved them out of your inbox. You get multi-factor prompts or sign-in codes you did not ask for. Microsoft emails you about a sign-in from a new location or device. Your password suddenly stops working.
What to do first
Call us on 855-248-2637 and say you think your account has been compromised. This is treated as an emergency. While you wait for us, or if you cannot reach us right away, change your password from a different device if you can, such as your phone using its own data connection rather than Wi-Fi, and choose a password you have never used before. If you get a multi-factor prompt you did not start, always deny it.
What we do
We sign the account out of every session on every device, reset the password and the multi-factor methods, and check for the things attackers leave behind: inbox rules that hide or forward mail, connected apps, changed contact details and any devices that were added. We then look at what was sent from the account and what was read, so we can tell you who may need a warning.
Warning the people you deal with
If messages were sent in your name, especially anything about payments or new banking details, we help you write a short note to the people who received them. Ask them to ignore those messages and to confirm any payment changes with you by phone. That one step stops most of the financial harm.
Afterwards
Once the account is secure, we go through how it happened. Usually it was a password reused somewhere else, or a fake sign-in page. We then fix the gap so it does not happen again. Our articles on spotting phishing and strong passwords are a good place to start.
Was this helpful?