Compromised email accounts don't always announce themselves. These are the places to check.

Signs Your Account May Be Compromised

• Sent items you don't recognize, including replies to threads you don't remember, or messages sent to contacts you don't normally email.
• New inbox rules you didn't create — a very common tactic is a rule that silently forwards or deletes incoming mail (often finance- or password-related messages) so you never see them.
• Contacts telling you they got a strange email or link from you.
• Unfamiliar sign-in activity — check your account's sign-in/activity log for logins from unexpected locations or devices.
• Password reset emails you didn't request from other services tied to that email address.

How to Check

1. In Outlook, go to File > Manage Rules & Alerts (or Settings > Mail > Rules on the web) and review every rule — delete anything you didn't create.
2. If you're on Microsoft 365, check My Sign-Ins at mysignins.microsoft.com for recent activity and locations.
3. Review your Sent folder for anything unfamiliar.

If You Confirm a Compromise

1. Change the password immediately, from a different, trusted device.
2. Enable multi-factor authentication if it isn't already on.
3. Delete any inbox rules you didn't create.
4. Sign out of all active sessions/devices (most providers have a "sign out everywhere" option).
5. Notify your IT team and anyone who may have received a malicious message from your account.

Common Questions

I changed my password — am I safe now?

Only if you also remove any malicious inbox rules and sign out of other active sessions — otherwise an attacker who was already logged in can remain in even after a password change.

How would someone have gotten my password in the first place?

Most commonly through phishing, reusing a password that was exposed in an unrelated data breach, or malware that captured keystrokes — which is exactly why multi-factor authentication matters even if your password does get exposed.